Your phone buzzes with a message from a number you do not know: “Is this still available for purchase?” Underneath it is a picture of a Facebook Marketplace listing, and the name on that listing is yours.
What is actually going on
You never posted anything for sale. That is exactly the point. Security researchers at Malwarebytes wrote about this trick on 6 October, after people sent them the messages they had received.
The scam is built out of two things that already belong to you: your name and your phone number. Those two details, kept together as a pair, are bought and sold in bulk by criminals who trade in stolen data. Many of those lists come from old leaks at companies you once gave your details to.
With that pair in hand, the scammer creates a fake listing in your name, takes a picture of it, and sends the picture to the number that came with the name. In the example Malwarebytes examined, the seller’s profile photo belonged to a completely different person who happened to share the same name. Nobody checked anything first.
What the message wants is one thing: your reply. Typing “that is not me” feels like correcting an honest mistake. For the sender, it is a confirmation that a real person reads this number.
Why it matters to you
A phone number whose owner answers is worth more than one that stays silent. Criminals resell lists of confirmed numbers, which is how one quick reply can turn into weeks of unwanted calls and messages.
The amounts are not small. The US Federal Trade Commission reported in April that in 2025 almost 30 percent of people who lost money to a scam said it had started on social media, with reported losses of 2.1 billion dollars. More money was reported lost to scams that began on Facebook than on any other platform.
Shopping was the most reported kind of social media scam: more than 40 percent of people who lost money that way said they had ordered something they saw advertised. A fake listing wearing your name is the opening move of that same game.
What you can actually do
- Do not answer it, not even to say “wrong number”, and not with “STOP”. Any reply tells the sender there is someone real on this phone.
- Do not tap the picture or any link inside the message. If you want to check, open the Facebook app yourself and look there.
- Treat the name in the message as bait, not as proof. A correct name and number are cheap, and they prove nothing.
- Look through your own account: check your Marketplace activity and your message requests for anything you did not post or send.
- Turn on two-factor authentication. In the app: profile picture, then Settings and privacy, then Settings, then Accounts Center, then Password and security, then Two-factor authentication. Choose your account and the method. An app that generates codes is safer than codes sent by text.
- Switch on the alerts about unrecognised logins, and use the Security Checkup page in your settings every few months.
- Report and block the sender inside your messaging app, then delete the message. In Facebook you can also report the conversation.
Common misunderstandings
Myth: they must have broken into my account
Usually nothing of yours has been hacked. The name and the number were bought, and the listing was invented. That is why your password is not the thing at risk here. Your willingness to answer is.
Myth: answering “that is not me” is harmless
That reply is the whole purpose of the message. The FTC has warned that answering an unexpected text confirms a working number belongs to someone who reads it. Nothing else in the message has to convince you.
Myth: there is no link, so there is nothing to fall for
This version asks for nothing except a reaction. Links, phone calls and payment requests come later, once a conversation exists. That is what makes it look so harmless at first.
What to watch for next
The recipe is a familiar brand, one true detail about you, and a reason to write back. It works in any app where strangers can message you about items, orders or accounts.
If you did reply, watch the next few weeks. A follow-up call or message claiming to be from your bank, a delivery firm or Facebook itself is a common second act. Check by opening the company’s own app or typing its address yourself, never by using a contact detail that arrived in a message.
The one thing to remember
A message that knows your name is not a message you can trust. Names and phone numbers cost criminals almost nothing, and your reply is the product they are selling. Ignore it, check the app yourself, and never answer a text you were not expecting.
Image: “Texting at Brooklyn Bridge” by Mith Huang, via Wikimedia Commons, licensed under CC BY 2.0.