An unsolicited message may show your name as the seller in a made-up Marketplace listing. Do not reply or open the listing; check Facebook directly instead.
In 60 seconds
- Facebook users who receive an unexpected Marketplace message should treat it as a scam warning.
- Check Facebook directly for unfamiliar listings, messages, logins, or account-recovery changes.
- Do not reply, click the listing, call a number, scan a QR code, or share a code.
- If your account appears changed, use facebook.com/hacked and preserve evidence of impersonation.
Who should care and what to do now
This warning is for Facebook users who receive an unexpected text, including an iMessage, asking whether an item is still available. The attached Marketplace listing may show your name as the seller even though you did not create it.
Do not reply. Do not tap the picture or listing. Do not call a number supplied in the message, scan a QR code, or share a one-time code or screenshot of a security message.
Instead, open Facebook independently. Check your Marketplace activity, recent logins, messages, email addresses, phone numbers, and recovery settings. If you see signs that someone accessed the account, Facebook's hacked-account page is facebook.com/hacked.
Why the message can feel convincing
Malwarebytes reported that the message uses a made-up listing and a seller name matching the recipient's name. In the example described by Malwarebytes, the profile picture did not match and belonged to another Facebook user with the same name.
The message is built to make people answer quickly. It can create curiosity and concern that someone is pretending to be them. Malwarebytes calls this a conversation lure: a message designed to start a reply by presenting a believable reason to respond.
A reply can tell the sender that the phone number is active. Malwarebytes says the number could then be more valuable to scammers, resold, or used in attempts involving malware, fraud, or account takeover. The exact motive behind any one message cannot be known without engaging with it.
What the name and number may mean
Malwarebytes said the sender likely had a phone number connected to a name and used those details to make the listing. The information could have come from a data breach, which is when private information is exposed or stolen from a service. The report does not identify a specific breach.
The use of your name does not by itself prove that your Facebook account was hacked. It may only mean that someone had matching name-and-number information. That is why the safest check is to inspect the account directly rather than follow the message's path.
If you find a real impersonating profile
If you find a profile that truly pretends to be you, save its web address before reporting it. Malwarebytes notes that Facebook treats impersonating profiles as a standards violation and provides a reporting process.
Limit personal information shared publicly on social media. If a message appears to come from someone you know but still seems wrong, contact that person through a different channel. Do not use contact details supplied in the suspicious conversation.
Does this affect me?
- Who may be affected
- Facebook users who receive an unsolicited message about a Marketplace listing, especially one showing their name as the seller. This is a scam pattern, not an established flaw in a specific product version.
- How to check
- Open Facebook independently and review Marketplace activity, recent logins, messages, email addresses, phone numbers, and recovery settings.
- What to do
- Leave the message unanswered and inspect your Facebook account directly. If you find signs of compromise, use facebook.com/hacked.
- What to avoid
- Do not reply, tap the listing, call a supplied number, scan a QR code, or share a one-time code or security-message screenshot.
Common questions
Does a Marketplace message using my name prove my Facebook account was hacked?
No. Malwarebytes said the sender may simply have a phone number connected to your name. Open Facebook independently and check recent logins, messages, Marketplace activity, and recovery settings for signs of account access.
What if I already replied to the message?
Do not continue the conversation or open anything it sends. Check Facebook directly for unfamiliar activity, and do not share codes, screenshots, or other information. If the account shows signs of compromise, use facebook.com/hacked.
How can I tell whether the profile is really impersonating me?
Open Facebook independently and inspect Marketplace and profile activity. If you find a profile that truly pretends to be you, save its URL and report it through Facebook's impersonation-reporting process.
Primary source
This draft uses Malwarebytes, “Facebook Marketplace scam uses your name and number,” published October 6, 2026: https://www.malwarebytes.com/blog/threat-intel/2026/10/facebook-marketplace-phish-uses-your-name-and-number. See the linked original for the complete technical details. Read the complete original source.
Concerned this may affect your computer or account?
Bring the exact alert, device, product, and timeline. Leon will help separate urgent action from noise.
Article history: Published Oct 6, 2026 at 9:02 am EDT. Updates and corrections are noted here when material facts change.
