I Sent Glitter, an AirTag, and Some Love to Facebook Marketplace Scammers

All posts

It is already late evening, and I just posted my old MacBook Pro for sale on Facebook Marketplace. I have sold many items this year, so I am aware of how ripe Marketplace is with scammers. I just hope that every fourth person contacting me is not a scammer. In a couple of minutes, I get a DM from “Michele Ge Romaine”, with the message, “Is this item still available for sale..”, and  I immediately know it’s a scammer. For some reason, this is a common opening line for scammers. What’s unusual is that their profile’s Facebook join date is 2009. Most scammers have fresh profiles, but there are some that have old, or ‘aged’ profiles. As far as I know, a hacked Facebook profile, costs around $25.

As you might suspect from my previous adventures with WhatsApp scammers and crypto recovery scams, I’m always curious about what the scammers are up to, so I decide do the dance.

Here in Hungary, the most common scam on Marketplace is “FOXPOST delivery”. The scammers send fake Foxpost links to unsuspecting sellers, convince them to log in to their fake online banking website and approve their device to be linked to the bank account on the phishing page, and drain their account. We might soon cover this type of scam in another blog post. Whenever I bump into a scam like this, I report the site to Google Safebrowsing, and move along. But this time, the scam is different.

phone screenshot showing a chat with a facebook marketplace scammer

They ask for my WhatsApp number, bank account name, bank name, IBAN, BIC, the full price of the item, and e-mail. I give them a fake one in the hope that this is really a scammer, and I am not playing with a legitimate buyer 🙂 Then I get an email from [email protected] and I immediately know it is 100% a scam.

facebook marketplace scammer email pretending to be a bank payment notification

The gist of the e-mail is that they are trying to convince me that the buyer had already sent the money to the “bank”, and the “bank” would release it once the shipment receipt is sent to the bank. Clearly, no bank in the world would deal with shipment receipts, but here we are.

Since I have a delivery address I decide to send them something.

They are expecting a MacBook, so let’s send them a MacBook…

photo of a macbook pro box

Add an Apple AirTag.

photo of an apple airtag inside an empty macbook pro box

Add some glitter with a smiling sun and a heart…

photo of a macbook pro box with an apple airtag inside it. The inside of the box is covered in glitter of various colors. There is a yellow sun and a pink heart drawn with glitter
As you can see, creating art is my passion.

Add a little bit of glue to make it harder to open…

a photo of a superglue packet and a corner of a macbook pro box. There is a puddle of glue on the corner where the box cover will touch it once closed

Some nice packaging…

photo of a box wrapped in colorful wrapping with cows, chickens, cats, pigs, roosters, trees and houses on it

And it is ready for shipping!

For some reason, the scammers insisted I had to send the package via GLS, so I sent it via GLS.

Meanwhile, I got two other emails from the totally legit bank [email protected].

screenshot of a whatsapp message asking the scammer whether their "bank" qonto is legitimate. The scammer answers 'of yes'
“Proof” that it is legit

In case you were wondering how much humanity these scammers have, let me just leave this here:

whatsapp chat screenshot telling the scammer that the victim was delayed because his brother was in the hospital, and he had to take care of him. The scammer responds by asking about the package

whatsapp chat screenshot where the victim tells the scammer that he needs the money for medicine. The scammer pretends that everything's alright

I sent the GLS shipment receipt to the fake bank. And I get the following reply from the bank.

fake bank payment notification email telling the victim that their sale was approved

That is what I call a customer-friendly bank. They even make sure that the MacBook I send to the buyer will work 100%.

And here we arrive at the next part of the scam.

fake bank statement about a suspended transaction asking the victim to pay 400 euros to release 1030 euros

So they are asking me to pay the buyer, but I have not received any money! This is getting quite outrageous, so let’s check where is my MacBook box.

screenshot of a package tracking log, which shows that the package had reached the parcel center in France Tinqueux, was expected to be delivered, but was then stored in the parcel center

And this is a mystery I have yet to solve. What happened here? It looked like they were interested in getting a working MacBook, e.g., checking whether I had signed out of iCloud. Did they get suspicious about the weight of the package? I believe they wanted to do a double scam here and both keep the MacBook and get the 400 EUR. 3 weeks later I got my MacBook box back, along with the AirTag.

Closing notes

Is this a Marketplace issue only? It is not. Every used item marketplace is full of scammers, where the payment is done outside of the marketplace. The reason you can trust Amazon or E-bay is that if there is a scam, and the payment was made through their systems, they usually refund you. Which means it is in their best interest to keep the scammers away. Even then, there are a lot of scammers on Amazon and E-bay, but it is still orders of magnitude smaller than on Facebook Marketplace or Vinted.

Is the same person behind the chat and the e-mail? I believe not. They probably work on a commission-based system, and the person behind the chat only gets the money once the delivery of the product is confirmed.

We also reported the domain to the domain registrar’s abuse contact e-mail. And marked the Facebook profiles as a scammer.

Conclusion

All in all, this is not a very sophisticated scam compared to the FOXPOST scam. Luckily, you can only lose the value of the shipped item and nothing else.

  • Used MacBook Pro box – $0
  • Glitter – $1
  • Glue – $1
  • Packaging – $2
  • Airtag – $48
  • Shipping to France – $30
  • Dreaming that I made the day of a scammer a little bit worse – priceless

Attachments

You can find the e-mails in PDF format here

01 02 03 04 05 06

 

 

 

Other posts by Zoltan Balazs

Cybersecurity IoT
header image
IoT Labs
Cybersecurity Labs