Fake Facebook List Is Using Your Name

A text-based Facebook scam uses your real name as a seller to trick you into replying. Malwarebytes warns that even a single reply helps the scam.

You get a text message from a number you don't recognize asking a perfectly normal question: "Is this still available for purchase?" Attached to the text is an image that appears to show a Facebook Marketplace listing. Maybe you're confused because you can't remember to sell anything. Then you look at the seller's name. Yours That little detail can be enough to make you respond with something like, "That's not me." And that reaction may be exactly what the person behind the message wants.

Security researchers at Malwarebytes are warning about a personal text scam that uses fake Facebook Marketplace listings with the recipient's name as the seller. This message can immediately create fear that someone has impersonated you online. Here's how this scam can set you up and what to do if you end up with one of these texts on your phone.

Kurt "CyberGuy" Knutsson shares practical ways to stay safer, smarter, and more confident in technology. Explore classes on stopping spam, phone security, financial protection, and using artificial intelligence to get better healthcare. Each class is free, easy to follow, and includes a free printable checklist.

View classes and register

A secret list that tells scammers you're an easy target

Scammers use Facebook Marketplace as the backdrop for personalized text messages to trick people into responding. (iStock)

How does a fake Facebook list work?

Malwarebytes analyzed the sample sent iMessage. The text asked if an item was still available and included an image similar to a Facebook Market listing. The clever part comes when you look at the supposed seller. There is a real name of the recipient.

However, Malwarebytes noticed something strange. The profile picture does not belong to the recipient. Researchers traced the image to another Facebook user who happened to have the same name.

This suggests that the scammer may have started with a matching name and phone number. These details could potentially come from a data breach or another source. An attacker can then use this name to create a convincing fake screenshot of the Marketplace. Seeing your name raises the obvious question: "Is someone impersonating me?" Before you know it, you're typing the answer.

This technique is known as conversational deception. Instead of immediately asking for a password or sending an obvious phishing link, the sender gives you a reason to start talking. In this case, the deception feels personal. Apparently someone listed your name on the market. You may want to correct the buyer or find out what happened. You may also worry that someone has created a fake Facebook account in your name.

The exact motivation behind this specific campaign remains unclear as determining the next step requires interaction with the sender. However, responding to suspicious texts has its own risks. The Federal Trade Commission warns that even responding to an unexpected text can confirm that a scammer has reached a business phone number. This can lead to more scam calls and texts.

Your answer may tell scammers more than you think

Think how harmless a reaction like "wrong person" is. You have not shared a password or sent any money. You have not clicked on a suspicious website. However, you've given the sender something useful: confirmation that someone is actively using the number and willing to respond. Malwarebytes reports that a live number can become more valuable to fraudsters and potentially resold to others. This number can also be combined with additional information collected from public profiles, breach databases or other sources. This could help set up another scam.

You may receive a fake delivery alert later. Another message can pretend to come from your bank. A scammer may eventually try to steal a verification code, redirect you to a malicious site, or create a longer conversation designed to gain your trust. We recently looked at what a scammer can do with your name, phone number and address. These details can become even more useful when criminals combine them with other personal information.

How AI can make personalized scams easier

Creating individual screenshots of the Marketplace for thousands of people at once required a lot of tedious work. Artificial intelligence and automation can change this equation. Malwarebytes says an attacker with a list of names and phone numbers could potentially use an AI agent to help create personalized scams at scale. However, the researchers have not proven that artificial intelligence created the specific example they examined. However, automation makes generating this type of personalization much easier.

This is a significant change in the way we judge suspicious messages. A text that knows your name gives you little assurance that the sender actually knows you. Personal information is exposed through breaches, scrubbed from public sources, and traded in criminal markets. When scammers put a few pieces together, they can make a random message surprisingly personal.

Does this mean your Facebook account has been hacked?

no Seeing your name on one of these fake Marketplace images does not by itself mean that someone has accessed your Facebook account. Marketplace screenshots may simply be made up. That's why I resist the urge to respond to a sender who asks what's up. Instead, check Facebook yourself.

What Apple Says About Suspicious iMessages

Apple says these types of deceptive messages use social engineering, a tactic in which fraudsters rely on impersonation and manipulation to convince people to share personal information. Criminals may pretend to represent a trusted company or organization while trying to obtain passwords, security codes or financial details.

Apple also mentions the important protection of iMessage. By default, users can't open links sent by an unknown iMessage sender until they add that person to their contacts or reply to it. This message gives you another reason to avoid replying to an unexpected text. Apple recommends that you treat suspicious and unexpected messages as possible scams and contact the company directly through a trusted channel. The company also says users can filter unknown senders, report suspicious messages, and block unwanted contacts through messages.

How to protect yourself from scam messages on iPhone

Apple's Messages app includes tools to help filter spam, report suspicious messages, and block senders. Since this Facebook Marketplace scam comes in via iMessage, here's how to use these protections on iPhone.

Tap the filter button in the conversation list.

To control alerts, tap Allow Notifications and choose which categories of anonymous messages can notify you.

Messages from unknown senders will appear in a separate folder instead of your main conversation list. Apple says you won't receive notifications for these messages unless you allow certain categories of unknown messages.

Facebook Marketplace dummy listing uses personal seller identity to make unexpected text appear more compelling. (Kurt "CyberGuy" Knutsson)

Did you not open the conversation? Swipe left, tap the Delete button, then tap Delete and Report Spam.

Already opened it? Tap Report Spam at the bottom of the conversation, then tap Delete and Report Spam.

Apple says that reporting an iMessage sends information about the sender and the content of the message to Apple. Then the message will be permanently deleted from your iPhone. However, reporting does not automatically block the sender, so follow the blocking steps below. If you have already responded, the report option may no longer be available. For SMS, MMS, or RCS messages that don't display a report option, Apple recommends contacting your wireless carrier directly.

Blocking prevents messages from that number from reaching you. The sender will not receive a notification that you have blocked them.

If a legitimate message appears there, open it, tap Not Spam, and then go to Messages.

Spam filter is enabled by default. You can check its status in Filter > Manage Filtering > Filter Spam.

Important: These protections can reduce exposure to phishing messages, but cannot guarantee that every personalized phishing attempt will be detected. Do not respond to a suspicious Marketplace message just because it contains your real name.

How to avoid Facebook Marketplace fake texts

Such a message is designed to get you to react. Instead, take a moment and research through channels you trust.

Even if we tell the sender they have the wrong person, they can confirm that someone is actively using the number. The FTC advises against responding to unsolicited messages from unknown numbers.