Security researchers at Malwarebytes have identified a text-based fraud scheme that fabricates Facebook Marketplace listings to trick recipients into believing their identity is being misused online. The goal is to provoke a response that confirms the phone number is active and reachable.
The attack typically arrives as a text from an unknown number asking if an item is still for sale, accompanied by an image that mimics a Marketplace post. In the example Malwarebytes analyzed, sent via iMessage, the recipient's real name appeared as the seller. However, the profile photo in the screenshot did not match the victim. Researchers traced the image to a different Facebook user with the same name, indicating the attacker likely obtained the name and phone number from leaked data or similar sources.
This approach acts as a conversation lure. Rather than demanding credentials or sending a phishing link immediately, the sender offers a personal reason to engage. Victims may feel compelled to correct the perceived error or investigate potential account impersonation. The specific motive behind this campaign remains unclear, as determining it would require interacting with the sender, which carries its own risks.
The Federal Trade Commission warns that even a brief reply validates the phone number as active. A confirmed live number is more valuable to criminals and may be resold or combined with other data from public profiles or breaches to facilitate future scams, such as fake delivery notices or bank impersonations. While Malwarebytes notes that AI could potentially enable attackers to mass-produce these personalized lures, researchers have not confirmed that AI generated the specific example they reviewed.
Apple describes this tactic as social engineering, where scammers use impersonation to manipulate users into sharing sensitive information. By default, iMessage prevents users from opening links from unknown senders until they reply or add the contact, providing an additional reason to avoid responding to unexpected texts. Apple advises treating suspicious messages as potential scams and contacting organizations directly through trusted channels.
Receiving such a message does not automatically mean a Facebook account has been compromised. A fabricated screenshot does not prove an impersonating profile exists. Users should independently open the Facebook app to check Marketplace activity and account security for unfamiliar logins or changes. If a message appears to come from a known contact, verify the situation through a different communication method.
iPhone users can utilize Messages app tools to filter unknown senders, report suspicious content, and block numbers. Reporting sends message data to Apple and deletes it from the device but does not automatically block the sender. Users can also forward spam texts to 7726 (SPAM) to aid wireless providers in identifying similar threats. If unauthorized account access is discovered, users should initiate Facebook's account recovery process, update passwords, and enable two-factor authentication.