The scheme, described by Malwarebytes researcher Pieter Arntz on 6 October, uses an apparently ordinary buyer enquiry accompanied by an image resembling a Marketplace advertisement. The message asks, “Is this still available for purchase?”, while the supposed seller is identified by the recipient’s own name.
The personalised detail turns an unfamiliar message into an apparent case of identity misuse. A recipient may reply to deny having advertised the product or demand an explanation, inadvertently confirming that the targeted telephone number is active.
Arntz examined one example delivered through Apple’s iMessage service. Although the seller’s name matched the recipient’s, the accompanying profile photograph belonged to another Facebook user who happened to share that name. That discrepancy suggested the image was assembled to look credible rather than obtained from a genuine listing belonging to the recipient.
The investigation did not establish where the sender acquired the matching name and telephone number. Arntz said such combinations might be drawn from exposed personal information, including data traded following security breaches. No particular breach was identified as the source of the information used in the example.
The precise objective of the messages also remains unconfirmed. Researchers have not demonstrated that every recipient is being directed to a malicious website, asked for payment or subjected to an account takeover. The immediate concern is that replying opens a channel for further approaches by an unknown sender.
Even a brief correction can distinguish an active telephone number from one that is unused or ignored. That information can be valuable to fraudsters seeking responsive targets for subsequent phishing messages, account theft attempts or other deceptive communications.
The technique relies on a misleading premise rather than an immediate demand for money. Instead of claiming that a victim has won a prize or owes a payment, it creates an apparent reputational problem: someone seems to be selling goods under the recipient’s identity.
The intended reaction may be curiosity, alarm or a desire to put the record straight. The sender needs only an initial response to begin an exchange, although the available evidence does not show what happened after the message in the documented example.
Arntz also raised the possibility that automated tools could help criminals prepare personalised screenshots from lists of names and telephone numbers. Such scaling remains a plausible explanation, not proof that artificial intelligence was used in the observed case.
The incident illustrates why a familiar name appearing in a screenshot is not evidence that an account has been accessed. Images purporting to show Marketplace listings can be fabricated, and a matching name alone cannot authenticate a seller’s identity or establish that an advertisement exists on Facebook.
A message arriving through iMessage also should not be confused with a notification generated inside Facebook. The communication route matters because an unsolicited text can contain an image of an online listing without demonstrating any connection to the platform’s actual records. A recipient who does not recognise the goods should therefore avoid treating the pictured advertisement as authentic solely because the screen layout resembles a familiar shopping interface or includes apparently accurate personal details.
Users receiving such enquiries can check their Marketplace listings and account activity by opening Facebook independently, rather than following material supplied by an unexpected correspondent. Security specialists advise examining messages, unfamiliar logins and changes to account recovery details if there is reason to suspect unauthorised access.
Malwarebytes advises recipients not to answer unsolicited messages from unknown senders, follow links contained in suspicious conversations or disclose one-time verification codes. Where a message appears to come from someone familiar, checking through a separate established contact method can help verify its origin.
People who discover an actual impersonating profile can preserve evidence and use Facebook’s reporting process. Meta provides mechanisms for reporting accounts that pretend to represent another person, while its Marketplace safety guidance includes procedures for flagging suspicious listings and sellers.
The warning concerns screenshots presented in text messages, not a confirmed vulnerability in Facebook Marketplace itself. Nor does the described incident establish that the recipient’s Facebook account was compromised. The investigated image, notably, carried a profile photograph associated with a different individual sharing the same name.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
