You receive a text from an unfamiliar number asking, “Is this still available for purchase?” Attached is an image that looks like a Facebook Marketplace listing. At first, you might feel confused—after all, you don’t recall selling anything. But then you notice your name as the seller, which can trigger a knee-jerk reaction like, “That’s not me.” Ironically, that’s precisely the response the sender is aiming for.
Security experts from Malwarebytes are sounding the alarm about a targeted text scam that leverages fake Facebook Marketplace listings where the victim’s name is used as the seller. This tactic can spark anxiety about someone impersonating you online. Let’s break down how this scam operates and what to do if you find yourself facing one of these texts.
How the fake Facebook Marketplace listing works
Malwarebytes looked into an example of this scam via iMessage. The text inquired if an item was still for sale, accompanied by a photo that mimicked a Facebook Marketplace listing. The trick lies in the supposed seller’s name—it’s the recipient’s actual name.
However, Malwarebytes found something unusual: the profile picture didn’t match the recipient. Investigations revealed the image belonged to another Facebook user with the same name. This indicates that the scammer might have obtained the name and phone number, possibly through hacked data or other sources, to create a believable fake Marketplace image. When you see your name, it’s natural to think, “Is someone pretending to be me?” and you could find yourself typing a reply almost instinctively.
Why scammers want you to respond
This approach is known as a conversation lure. Instead of asking for sensitive information right away, the scammer engages you in conversation. The sense of familiarity—seeing your name—might compel you to respond, either to clarify the listing or to investigate further. There’s also the concern that someone has set up a fake account using your name.
While the exact goal of this particular scam isn’t evident, “chatting” with the sender is risky. The Federal Trade Commission cautions that even responding to an unexpected text can confirm to scammers that they’ve reached a functioning number, which may lead to further scam attempts.
Your reply may tell scammers more than you realize
A seemingly innocuous reply like “wrong person” can feel harmless. You think you’re not giving away any sensitive info, but you’re providing the sender with valuable insight: confirmation that someone is at the number and will engage. According to Malwarebytes, a live number becomes more appealing to scammers and could be resold or used for other scams.
This can lead to more unsolicited messages, like fake delivery alerts or phony bank communications. Scammers may aim to trick you into providing verification codes or connect you to malicious sites. The combination of your name, phone number, and potentially other personal details enhances the threat, making these messages even more convincing.
How AI could make personalized scams easier to scale
The traditional labor of crafting individualized Marketplace scams for many people has been simplified by AI. Malwarebytes notes that an attacker armed with a list of names and phone numbers can use AI tools to generate personalized scams more efficiently. Even though the specific case they reviewed may not have been AI-generated, the technology makes such scams frighteningly easy to execute.
This shifts how we perceive suspicious messages. Just because a text uses your name doesn’t mean the sender knows you personally. Various breaches expose personal information, which might be gathered or sold to scammers, enabling them to create messages that seem surprisingly relatable.
Does this mean your Facebook account was hacked?
No, seeing your name on a counterfeit Marketplace image doesn’t imply your Facebook account has been compromised. It’s likely just a fabricated screenshot. It’s best to refrain from replying; instead, check your Facebook account directly.
What Apple says about suspicious iMessages
Apple indicates that these misleading messages rely on social engineering tactics, wherein scammers manipulate individuals into providing personal information, often by pretending to represent a credible organization.
Apple also highlights an iMessage security feature: users can’t open links sent by unknown senders unless they first add them to contacts or respond. This emphasizes the need to be cautious with unexpected texts. Apple advises treating such messages as potential scams and to communicate with companies only through verified methods.
How to protect yourself from scam texts on iPhone
Apple’s Messages app has options to filter out unwanted messages. Since these Marketplace scams come via iMessage, here’s how to utilize those features:
Turn on screening for unknown senders
- Open the Messages app.
- Tap the Filter button in the conversation list.
- Hit Manage Filtering.
- Activate Screen Unknown Senders.
- Adjust notification settings as needed.
Messages from unknown senders will be sorted into a separate folder. You won’t get notifications for these unless you’ve selected specific categories to be alerted on.
Report a suspicious iMessage
- Open Messages.
- Locate the suspicious conversation.
- If unopened, swipe left, tap Delete, then Delete and Report Spam.
- If already opened, tap Report Spam at the bottom and then delete.
Reporting sends the message content and sender information to Apple while deleting the text from your phone. It’s worth noting that reporting doesn’t block the sender, so follow the appropriate steps for that as well.
Block the scammer’s number
- Open Messages.
- Select the suspicious conversation.
- Tap the sender’s icon above.
- Click Info.
- Scroll to Block Contact.
Blocking means you won’t receive further text messages from that number, and the sender won’t be notified.
Check messages Apple has flagged as spam
- Open Messages.
- Tap Filter.
- Select Spam to review filtered messages.
- If a legitimate message is identified, open it, select Not Spam, and move it back to Messages.
- Spam filtering is enabled by default, and its status can be checked under Filter > Manage Filtering > Filter Spam.
Keep in mind that these protective measures can help reduce exposure to scam texts but won’t catch every personalized phishing attempt.
How to stay safe from fake Facebook Marketplace texts
Messages like these are crafted to provoke a quick reaction. Instead of instantly replying, take a moment to evaluate using reliable channels.
1) Don’t reply to the text
Even responding with a correction can confirm the number is in use. The FTC advises against replying to unexpected messages from unknown numbers.
2) Don’t use links or contact information in the message
Refrain from clicking any links, calling numbers, or scanning QR codes included in the text. Always log into Facebook directly through the app or browser instead of using information from a suspicious message.
3) Use strong antivirus software
A good antivirus system can safeguard against malicious links or malware attempts. It can alert you about harmful sites before they become problematic. Protect all your devices with reputable antivirus solutions to fend off phishing and ransomware threats.
4) Check your Facebook account independently
Log onto Facebook and scrutinize your Marketplace activity. Look for anything unusual and review your account security.
5) Check with a known sender another way
If a message appears to come from someone you know, reach out through a different method, such as a saved contact number.
6) Report and block suspicious texts
For reporting and blocking on an iPhone, follow the specified steps above. Android users should utilize their messaging app features. The FTC suggests forwarding unwanted messages to 7726 (SPAM) to help wireless providers combat similar texts.
7) Report a Facebook impersonator
If you discover someone has created a fake profile posing as you, save the profile URL and report it to Facebook. However, a mere screenshot doesn’t confirm that there’s an actual impersonating profile.
8) Secure your Facebook account if something looks wrong
If you notice unauthorized entries or changed information, initiate Facebook’s account recovery immediately. Also, update your password and activate two-factor authentication.
9) Reduce the personal information scammers can find
This incident illustrates how exposed personal details can be weaponized by scammers. Although you might have your name and number on various public platforms, it’s wise to limit the visibility of your personal data to mitigate future scams.
What if you already replied?
Don’t assume responding to a single message means your account is hacked. Your next steps should depend on the interaction’s depth.
- If it was just a text reply, cut off the conversation, block the sender, and report the message if possible. Stay alert for suspicious messages or calls afterwards.
- If you clicked a dubious link and entered credentials, change your Facebook password immediately, check for any unauthorized activities, and enable two-factor authentication.
- If you shared a one-time security code, act quickly. Visit the affected account to change your password and assess its security settings.
- If you downloaded anything, terminate contact with the sender and run a security scan using trusted antivirus software.
Kurt’s key takeaways
This scam’s effectiveness hinges on the personal details used, like seeing your own name associated with a listing you didn’t create. Naturally, you’re inclined to investigate. However, that impulse can lead to trouble.
Instead, head to Facebook directly and confirm your account’s status. If nothing appears unusual, block the sender and dismiss the text. If an issue arises, secure your account right away.
The broader concern is how easily scammers exploit our personal information to craft seemingly legitimate communications. This should serve as a reminder to be cautious rather than trusting of unexpected messages featuring accurate information about ourselves.
