A Marketplace Listing With YOUR Name as the Seller. Replying Is the Trap. (2026)

Don't reply — check Facebook yourself. The text carrying a Marketplace listing screenshot with your name as the seller is built from breach data pairing your phone number with your name, and any reply confirms a live number — inventory that resells to other scammers. There is usually no listing at all; the photo on the fake profile may even belong to a different Facebook user who genuinely shares your name. Open Facebook yourself instead: check Marketplace activity, recent logins, and recovery settings, use facebook.com/hacked at any sign of compromise, and report a truly impersonating profile through Facebook's impersonation-report process.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — October 6, 2026 →

Why you’re seeing this now

Malwarebytes documented the lure on October 6: a text arrives with a screenshot of a Facebook Marketplace listing, and the seller's name matches yours — paired from breach data that ties your phone number to your name. The pull is reputational panic: “That isn't me!” Correcting the record feels urgent and harmless. It isn't. Any reply confirms a live number, and live numbers are inventory — resold to other scammers, or worked into malware drops, relationship scams, or a Facebook-takeover attempt. What once took a scammer hours per target now scales: an AI agent plus a breached name-and-number list manufactures a personalized screenshot for thousands of phones. The photo on the fake profile may even belong to a different Facebook user who genuinely shares your name — one more layer of borrowed truth. Don't reply, don't click, don't call a number in the thread, don't share codes or screenshots. Open Facebook yourself instead: check Marketplace activity, recent logins, and recovery settings, use facebook.com/hacked at any sign of compromise, and report a profile that is truly impersonating you through Facebook's impersonation-report process.

Five red flags — any one is enough

A stranger texts about a Marketplace listing — and the seller's name is your name.

The urge to correct it immediately (“That isn't me!”) — that's the engineered response, not your idea.

Pressure to reply, click, call a supplied number, scan a code, or share a one-time code or screenshot.

A profile photo that's almost you — actually a different Facebook user with your exact name.

Any follow-up asking you to “verify” your Facebook account outside the app.

Your next three moves

Verify through a channel you open yourself — open Facebook directly (the app, or facebook.com typed yourself) and check Marketplace activity, recent logins, and recovery settings. Use facebook.com/hacked at any sign of compromise, and report a profile that is truly impersonating you through Facebook's impersonation-report process — never through a number or link in the text thread.

Refuse the reply: don't text back, don't click, don't call a supplied number, don't share codes or screenshots. Any reply confirms a live number — and live numbers are inventory, resold to other scammers or worked into malware drops, relationship scams, and takeover attempts.

Report the text at reportfraud.ftc.gov and to the FBI at ic3.gov — and check any link or number from the message via the $2 instant check before you engage.

Why does the scammer want a reply instead of my password?

A reply proves your number is live. Verified live numbers resell to other scammers and feed later fraud — malware, romance and investment cons, or account-takeover attempts.

What should I do instead of replying?

Delete without responding. Open Facebook independently and check Marketplace activity, recent logins, and recovery settings; use facebook.com/hacked if anything looks off, and report impersonating profiles to Facebook.

Is someone really selling things under my name?

Usually there is no listing at all — the screenshot is fabricated from a name-and-number pair bought from breach data.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.