Malwarebytes warns that scammers are sending fake Facebook Marketplace listings bearing recipients’ names to lure them into responding.
Even a reply correcting the supposed mistake can confirm that a phone number is active.
Consumers should check Facebook directly and avoid engaging with unexpected messages.
An unexpected message asking about something you supposedly listed on Facebook Marketplace could be a scam designed to get your attention—and a response.
In an October 6 blog post, Malwarebytes researcher Pieter Arntz described messages containing fabricated Marketplace listings that identify the recipient as the seller. One example arrived via iMessage, asking whether an item was still available. The listing used the recipient’s name but a photo of another Facebook user with the same name.
The apparent impersonation creates an incentive to correct the sender. Arntz suggests attackers could use names and phone numbers obtained through data breaches, although the source of the information and the campaign’s ultimate objective remain unconfirmed.
A reply can have consequences even when it contains no sensitive information. The Federal Trade Commission warns that answering an unfamiliar sender confirms a working telephone number, potentially inviting additional scam calls and texts.
Avoid conversations with strangers
The FTC has also described conversation-starting scams in which strangers build trust before pitching fraudulent cryptocurrency investments. That is a broader warning about unsolicited texts, rather than an established outcome of this Marketplace scheme.
Consumers concerned about their Facebook accounts should open Facebook independently to review listings, logins and account settings. Malwarebytes advises reporting genuine impersonation profiles and withholding verification codes.
For unexpected texts, the FTC recommends avoiding replies and links, reporting the message through the phone’s junk-reporting feature or forwarding it to 7726, and deleting it. Consumers who lose money to a scam can report it atReportFraud.ftc.gov.