Hacked Marketplace Account Fuels Cash App Scam

A scammer used a hacked Facebook Marketplace account to pose as a seller and direct a buyer to send $1,000 to a Cash App account supposedly belonging to the seller’s wife. The payment account had been opened using another person’s stolen identity, illustrating how account impersonation and identity theft can combine to steal money and wrongly implicate an innocent person.

Key findings

• A Facebook Marketplace account was hacked and used to impersonate a seller offering items for sale.
• The scammer instructed the prospective buyer to pay $1,000 to the seller’s supposed wife through Cash App.
• The Cash App account was created shortly before the fraud using Amanda Smith’s Social Security number and date of birth, although other account details did not match her.
• After receiving the payment, the account distributed the money in smaller amounts to a network of other accounts within hours.
• The case demonstrates that a name and identity details associated with a payment account do not necessarily prove who controlled it.

Who’s being targeted

• Commonly targeted roles: All employees, Online marketplace users, Finance and accounts-payable staff, Customer support teams, Fraud and identity-protection teams.
• Affected industries: Consumer online marketplaces, Peer-to-peer payment services, Retail consumers.
• Attack channels: facebook.
• Impersonated: A legitimate Facebook Marketplace seller.

Awareness takeaways

• Treat a request to pay a different person’s payment account as a warning sign, especially when a marketplace seller says the account belongs to a spouse or associate.
• Before sending money through a marketplace, verify the seller through a separate, trusted method because a familiar account may have been taken over.
• Use unique passwords and multi-factor authentication on social-media accounts used for buying or selling, since a compromised account can be used to exploit the owner’s trusted contacts and listings.
• If identity theft is suspected, document mismatched account details and report the issue quickly to the payment provider and relevant authorities.

Red flags to watch for

• The seller directs payment to an account under a different person’s name: the seller’s alleged wife.
• The payment request comes from an account that was hacked rather than from the real seller.
• The buyer is asked to send money before independently confirming the listing and seller.