Got a text asking if your Facebook Marketplace item is still available, with your own name on the listing? Do not reply. Check Facebook directly instead.
Do not reply, tap the image or scan any code in the text. Open the Facebook app yourself and check Marketplace, recent logins, and the email and phone on your account. If anything changed, use Facebook's hacked account page. If a profile is pretending to be you, report it through Facebook's impersonation form.
SummaryA text arrives from a number you do not know. It asks if something is still available for purchase, and attached is what looks like a Facebook Marketplace listing. When you look closer, the seller's name is yours. The natural reaction is to reply and say you are not selling anything. That reply is exactly what the sender wants.
Malwarebytes described this scam on 6 October 2026, and Hudson Valley Country reported on 23 October 2026 that the New York State Sheriffs' Association was warning people about it. This guide explains how the lure works and uses Facebook's scam advice, its hacked account page and its impersonation reporting page to show what to do. One wrong step can cost you the account, so know what you are doing before you start.
Last checked: 31 October 2026.
Do not reply, tap the image or scan any code in the text. Open the Facebook app yourself and check Marketplace, recent logins, and the email and phone on your account. If anything changed, use Facebook's hacked account page. If a profile is pretending to be you, report it through Facebook's impersonation form.
Malwarebytes calls this a conversation lure. Seeing your own name on a listing you never made creates curiosity and worry, and pushes you to correct the mistake. Malwarebytes says that when you reply to a phishing text, you tell the scammer this is a live number. It says your number then becomes more valuable to scammers and can be resold. A reply can also open a longer chat that ends with a link, a code request or a fake support contact.
These steps follow the advice Malwarebytes gives, and they match Facebook's own guidance on scams. If you have already tapped a link, see our guide on what to do after clicking a phishing link.
Facebook's Avoiding scams page gives a short set of principles. It says to slow down, because scammers try to create urgency or threaten that you will lose your account. It says to spot check by researching the details before you act. It says that if you see something you think is a scam, do not respond, and its third rule is Don't send: no reputable organisation will demand payment on the spot, and people you do not know asking for money are a warning sign. For emails that claim to come from Facebook, it says you can view recent emails sent from Facebook in your settings.
The same page recommends two factor authentication, login alerts so you are told when someone tries to access your account, reviewing your previous sessions, and the Security Checkup tool.
Meta's prohibited commercial practices policy states that Meta aims to protect users and businesses from being deceived out of their money, property or personal information. A scam built around fake Marketplace listings falls under the kind of deception that policy describes.
| What you find | What to do |
|---|---|
| A login you do not recognise | Log out that session and change your password |
| Email or phone changed | Go to facebook.com/hacked and follow the steps |
| Listings you did not post | Delete them, change your password, and check sessions |
| A profile copying you | Report it through Facebook's impersonation form |
| Nothing changed | Ignore the text and keep two factor authentication on |
Facebook's hacked account page points you to facebook.com/hacked if you think someone has access to your account. Facebook's impersonation page explains how to report a profile or Page that pretends to be you, including if you do not have a Facebook account. If you also received a password reset you did not ask for, read our guide to a Facebook password reset email you did not request.
Marketplace is a busy place to buy and sell in Malaysia, and Malaysians are used to sellers moving chats to other apps. That makes a text about a listing feel normal. Keep Marketplace conversations inside Facebook Messenger, where you can see the buyer's profile and report them. If you were already tricked into a payment, our guide to the first hour after a Marketplace scam covers what to do.
The text Malwarebytes described is one version of a wider trick: show you something with your name on it so you feel you must respond. Expect the wording to shift over time.
Each one ends with the same ask: reply, tap, scan or share a code. Facebook's advice to slow down and check details independently applies to all of them. If the message mentions money waiting for you, remember that Facebook's own scam page says no reputable organisation will demand payment on the spot, and lists people you do not know asking for money as a warning sign.
The scam starts with a name and a phone number that someone already has. You cannot pull that information back from every list, but you can make the number less useful to scammers and make your Facebook account harder to reach through it.
None of this stops every text, but each step cuts the value of a reply, a code or a leaked number. If another text arrives later, the same rule applies: do not reply, and check Facebook yourself.
Ignoring the text is enough for the bulk of people. It is worth getting help when you shared a code or a password, when your email or phone on the account changed, when listings or ads appeared that you did not create, or when a fake profile is selling in your name. Fake recovery helpers also contact people who post about scams publicly, which adds risk.
If your account or your selling reputation is at stake, a structured security review is the safer route. AwareXone does this work. See our account security help page.
A case review helps when facebook.com/hacked did not restore access, when a profile keeps selling in your name after reports, or when you are not sure what the scammer saw. We are a Malaysia-based team, independent of Meta, and we use only the official routes. We do not ask for your password, and we cannot promise a result. See how we work on our trust page.
More free guides on the same kind of problem.
