Facebook Marketplace Scam Impersonates Users to Harvest Phone Numbers
A sophisticated phishing scam is circulating on Facebook Marketplace, using fake listings with the recipient's own name to trick them into replying and revealing their active phone number.
Scammers are employing a new tactic on Facebook Marketplace, sending unsolicited messages that feature a fabricated listing where the supposed seller is the recipient themselves. This "conversation lure" aims to provoke a natural reaction, such as "That isn't me," prompting the user to engage with the message. The fabricated listing often includes a profile picture that may not match the recipient, but the use of their name is intended to create a sense of urgency and personal relevance.
The psychological manipulation behind this scam is designed to exploit curiosity and a desire to correct a perceived impersonation. By replying to such a message, users inadvertently confirm that their phone number is active and in use. This confirmation significantly increases the value of the phone number on the black market, making it a prime target for further fraudulent activities.
While the exact motive for this specific scam remains under investigation, confirming a live phone number is a crucial step for cybercriminals. These validated numbers can be resold to other scammers, used for account takeover attempts, to initiate further phishing campaigns, or to build relationships that lead to financial fraud. The personalization of the scam, using the victim's own name, makes it far more convincing than generic phishing attempts.
This tactic is likely amplified by the widespread availability of personal data from previous data breaches. Names and associated phone numbers are readily available on the dark web, often for a nominal cost. Coupled with advancements in AI, threat actors can automate the creation and distribution of these personalized fake listings at scale, dramatically increasing their return on investment and the potential reach of the scam.
To protect themselves, users are advised to limit the amount of personal information shared publicly on social media platforms. Scammers leverage this publicly available data to enhance the credibility of their fraudulent schemes. It is crucial to remain vigilant and skeptical of unsolicited messages, especially those that seem too personalized or urgent.
Users should avoid responding to any messages from unknown senders. If a message appears to be from someone you know but seems suspicious, it is best to verify its authenticity through a separate, trusted communication channel. Furthermore, users should exercise caution and refrain from clicking on links, calling numbers, scanning QR codes, or sharing any sensitive information like one-time codes or security message screenshots provided within such messages.
For those concerned about their Facebook account, it is recommended to independently log in to Facebook and review Marketplace activity, recent logins, and security settings. The platform provides a "hacked" reporting tool at facebook.com/hacked for users who suspect their account has been compromised. If a profile is indeed impersonating you, it should be reported to Facebook immediately, as impersonation violates the platform's community standards.
Tools like Malwarebytes Scam Guard can assist users in identifying potentially fraudulent messages and provide guidance on appropriate actions. By staying informed and practicing safe online habits, individuals can better defend themselves against evolving social engineering tactics like this Facebook Marketplace scam.