A new text-message scam is using people's own names against them. Security researchers at Malwarebytes are warning about a personalized scheme in which a stranger sends a text asking whether an item is still available for purchase, along with an image that appears to show a Facebook Marketplace listing. The twist is that the seller's name on the listing belongs to the person receiving the message.
The message is designed to trigger alarm. Recipients may briefly wonder whether someone has hijacked their identity or created a fake Facebook account in their name. That instinct to respond — even with a simple correction like «that's not me» — is exactly what the sender appears to be after. Malwarebytes describes the tactic as a conversation lure: rather than immediately requesting a password or pushing an obvious phishing link, the scammer manufactures a reason for the target to start talking.
In the example analyzed by Malwarebytes, the text arrived through iMessage and asked whether an item was still available. The attached image resembled a Marketplace listing, and the supposed seller's name matched the recipient's real name. But the profile photo did not belong to that person. Researchers traced the picture to a different Facebook user who happened to share the same name. That detail suggests the scammer may have started with a name and a matching phone number, possibly obtained from breached data or another source, then used those details to build a convincing fake listing.
The exact motive behind the campaign remains unclear because determining the next step would require engaging with the sender. Still, replying to an unexpected text carries its own risks. The Federal Trade Commission warns that even a response can confirm to a scammer that a phone number is active and monitored. Malwarebytes notes that a live number can become more valuable on the criminal market and may be resold to other fraudsters.
From there, the danger can escalate. A confirmed number could be combined with information scraped from public profiles or exposed in data breaches to set up follow-up scams. A victim might later receive a fake delivery alert, a message pretending to come from a bank, or an attempt to steal a verification code. Each new contact builds on the last, and a longer conversation can be used to gain trust before a request for money or credentials.
What makes this campaign notable is the personalization. Creating individual Marketplace screenshots for thousands of targets would once have required tedious manual work. Malwarebytes says an attacker armed with a list of names and phone numbers could potentially use an AI agent to generate personalized lures at scale. The researchers have not established that artificial intelligence created the specific example they examined, but they point out that automation makes this kind of tailoring far easier to produce.
That shift matters for how people judge suspicious messages. A text that knows your name is no longer strong evidence that the sender actually knows you. Personal information is routinely exposed through breaches, scraped from public sources, and traded in criminal marketplaces. Once scammers connect a few pieces, a random message can feel surprisingly personal.
Seeing your name on a fake Marketplace image does not by itself mean someone has accessed your Facebook account. The listing may simply be fabricated. Security experts advise against replying to the sender to ask what is going on. Instead, check Facebook directly through the app or website to see whether any unauthorized activity exists.
Apple describes this type of deceptive messaging as social engineering, a tactic in which scammers rely on impersonation and manipulation to persuade people to share personal information. Criminals may pose as a trusted company or organization while trying to obtain passwords, security codes, or financial details. Apple also points to an iMessage protection: by default, users cannot open links sent by an unknown sender until they add that person to their contacts or reply to the message. That default gives recipients another reason to avoid responding to an unexpected text. Apple recommends treating suspicious, unexpected messages as potential scams and contacting the company directly through a trusted channel.