I Sent Glitter, an AirTag, and Some Love to Facebook Marketplace Scammers

It is already late evening, and I just posted my old MacBook Pro for sale on Facebook Marketplace. I have sold many items this year, so I am aware of how ripe Marketplace is with scammers. I just hope that every fourth person contacting me is not a scammer. In a couple of minutes, I get a DM from “Michele Ge Romaine”, with the message, “Is this item still available for sale..”, and  I immediately know it’s a scammer. For some reason, this is a common opening line for scammers. What’s unusual is that their profile’s Facebook join date is 2009. Most scammers have fresh profiles, but there are some that have old, or ‘aged’ profiles. As far as I know, a hacked Facebook profile, costs around $25.

As you might suspect from my previous adventures with WhatsApp scammers and crypto recovery scams, I’m always curious about what the scammers are up to, so I decide do the dance.

Here in Hungary, the most common scam on Marketplace is “FOXPOST delivery”. The scammers send fake Foxpost links to unsuspecting sellers, convince them to log in to their fake online banking website and approve their device to be linked to the bank account on the phishing page, and drain their account. We might soon cover this type of scam in another blog post. Whenever I bump into a scam like this, I report the site to Google Safebrowsing, and move along. But this time, the scam is different.

They ask for my WhatsApp number, bank account name, bank name, IBAN, BIC, the full price of the item, and e-mail. I give them a fake one in the hope that this is really a scammer, and I am not playing with a legitimate buyer 🙂 Then I get an email from [email protected] and I immediately know it is 100% a scam.

The gist of the e-mail is that they are trying to convince me that the buyer had already sent the money to the “bank”, and the “bank” would release it once the shipment receipt is sent to the bank. Clearly, no bank in the world would deal with shipment receipts, but here we are.

Since I have a delivery address I decide to send them something.

They are expecting a MacBook, so let’s send them a MacBook…

Add an Apple AirTag.

Add some glitter with a smiling sun and a heart…

Add a little bit of glue to make it harder to open…

Some nice packaging…

And it is ready for shipping!

For some reason, the scammers insisted I had to send the package via GLS, so I sent it via GLS.

Meanwhile, I got two other emails from the totally legit bank [email protected].

In case you were wondering how much humanity these scammers have, let me just leave this here:

I sent the GLS shipment receipt to the fake bank. And I get the following reply from the bank.

That is what I call a customer-friendly bank. They even make sure that the MacBook I send to the buyer will work 100%.

And here we arrive at the next part of the scam.

So they are asking me to pay the buyer, but I have not received any money! This is getting quite outrageous, so let’s check where is my MacBook box.

And this is a mystery I have yet to solve. What happened here? It looked like they were interested in getting a working MacBook, e.g., checking whether I had signed out of iCloud. Did they get suspicious about the weight of the package? I believe they wanted to do a double scam here and both keep the MacBook and get the 400 EUR. 3 weeks later I got my MacBook box back, along with the AirTag.

Closing notes

Is this a Marketplace issue only? It is not. Every used item marketplace is full of scammers, where the payment is done outside of the marketplace. The reason you can trust Amazon or E-bay is that if there is a scam, and the payment was made through their systems, they usually refund you. Which means it is in their best interest to keep the scammers away. Even then, there are a lot of scammers on Amazon and E-bay, but it is still orders of magnitude smaller than on Facebook Marketplace or Vinted.

Is the same person behind the chat and the e-mail? I believe not. They probably work on a commission-based system, and the person behind the chat only gets the money once the delivery of the product is confirmed.

We also reported the domain to the domain registrar’s abuse contact e-mail. And marked the Facebook profiles as a scammer.

Conclusion

All in all, this is not a very sophisticated scam compared to the FOXPOST scam. Luckily, you can only lose the value of the shipped item and nothing else.

• Used MacBook Pro box – $0
• Glitter – $1
• Glue – $1
• Packaging – $2
• Airtag – $48
  
• Shipping to France – $30
• Dreaming that I made the day of a scammer a little bit worse – priceless

Attachments

You can find the e-mails in PDF format here

01 02 03 04 05 06