A new Facebook Marketplace scam is using people’s own names and phone numbers against them — and it’s spreading fast enough that South Florida businesses should pay attention. The lure arrives as a text asking “Is this still available for purchase?” with a fabricated Marketplace listing attached. When the recipient taps the image, the seller’s name matches their own.
Security researchers at Malwarebytes flagged the tactic on October 6, 2026, noting that the impersonation is likely automated at scale using AI agents and name-and-phone pairs pulled from data breaches. For a business, the risk isn’t just a nuisance text — it’s a vector for account takeover, fraud, and malware delivery aimed at your staff.
How the Facebook Marketplace Scam Works
The message looks like a buyer following up on a listing you never posted. Attached is a screenshot of a fake Marketplace listing with your name as the seller. In the examples researchers received, the profile photo belonged to a different person with the same name — a sign the attacker stitched together a name from a breach with a number to create a convincing shell.
The psychology is deliberate. A message implying you’re being impersonated triggers curiosity and a natural urge to correct the mistake — which is exactly the reply the scammer wants. Once you respond, you’ve confirmed a live number, and that number becomes more valuable on the resale market or is used directly for further attacks.
What makes this Facebook Marketplace scam different is scale. Manually spoofing one listing is low-yield. With an AI agent and a list of matching names and phone numbers from any number of breaches, the same attack becomes cheap to run against thousands of targets at once — including your employees, who may not realize a work phone has been exposed.
Why This Facebook Marketplace Scam Is a Business Risk
A single employee who replies to the lure has handed an attacker a verified, active phone number tied to a real person. From there, the scams compound:
- Account takeover. The same number may be the recovery path for a Facebook, email, or Microsoft account. A live number plus social-engineering is a route in.
- Fraud relationships. Scammers build trust over a conversation, then pivot to payment fraud, fake invoices, or “boss” pretexts.
- Malware delivery. A follow-up link or “security” prompt can drop credential stealers or remote-access tools onto a business device.
- Reputational harm. If a fake listing carries your business name, customers may report you before anyone realizes it wasn’t you.
The end result is that this Facebook Marketplace scam blurs the line between personal and professional exposure. A breach that leaked an employee’s personal number now becomes a way to reach that employee during work hours, using their real name to earn a moment of trust before the attack actually begins.
For a small or midsize business, a compromised employee number can quickly become a compromised Microsoft 365 login, a fraudulent wire, or a ransomware foothold. That’s why treating this Facebook Marketplace scam as a security event — not just spam — is the right posture. That’s why awareness is a security control, not a nice-to-have.
5 Ways to Protect Your Business from a Facebook Marketplace Scam
- Train staff not to reply to unsolicited messages. If the sender is unknown, silence is the correct response. Replying validates the number.
- Verify through a second channel. If a message claims to be from someone you know but feels off, confirm on a different channel before acting.
- Never click, call, scan, or share codes. No link in the conversation, no number supplied by the sender, no QR code, and never a one-time passcode or screenshot of a security prompt.
- Check Marketplace and account activity independently. Open Facebook on your own — not via the message — and review listings, recent logins, messages, and recovery settings. Use facebook.com/hacked if anything looks wrong.
- Report impersonation and preserve evidence. If a profile is genuinely impersonating you or your business, save its URL and report it. Facebook’s standards prohibit impersonation and provide a reporting path.
These steps apply whether this Facebook Marketplace scam targets a personal account or a company page. The pattern — a breach-fed, AI-scaled impersonation lure — is the same one behind many modern phishing campaigns, so the habits transfer directly to email and SMS security.
What to Do If Someone on Your Team Already Responded
Treat it as a potential compromise, not an embarrassment. Confirm what was shared, reset the affected account’s password, enable multi-factor authentication if it isn’t already on, and watch for unauthorized logins. If a work device was involved, have it checked before it’s used again.
Frequently Asked Questions
What is the new Facebook Marketplace scam?
It’s an impersonation lure where a scammer sends a message asking if a listing is still available, attaching a fake Marketplace listing that shows the recipient’s own name as the seller. Replying confirms a live number for follow-on fraud.
How do scammers get my name and number?
From data breaches. Name-and-phone pairs are bought and sold on dark-web markets, and AI agents now automate creating the fake listings at scale.
Should I reply to tell the sender they have the wrong person?
No. Replying is what the scammer wants — it marks your number as active and raises its value for resale or further attacks.
Businesses that want a second set of eyes on account security, phishing training, or endpoint protection can talk to our team about cybersecurity services for South Florida businesses. If you’d like help reviewing your exposure or hardening your defenses, book a consultation — we’ll walk through it with you.
Source: Malwarebytes Labs, “Facebook Marketplace scam uses your name and number,” October 6, 2026.