Phishing Messages That Target Car Dealers on Facebook

A message arrives in Messenger while a rep is mid-thread on a 2019 Highlander. The profile looks like Facebook Support. There is a blue badge-shaped graphic, a warning that Marketplace selling will be paused, and a button to "verify your business." The rep is busy. Clicking feels like the responsible thing. Ten minutes later they are on a page that wants the password and a login code. That is not support. That is the whole game.

Phishing messages that target car dealers on Facebook are written for people who live in Messenger all day, who already jump off-platform for deposits and credit apps, and who are used to official-looking warnings about listings. The floor is a high-volume target because a captured Facebook login is captured inventory, captured buyer threads, and often a captured Page.

This article is a recognition and response guide for managers and reps. It covers how these messages usually arrive, phrases and setups to treat as hostile, a protocol when someone already clicked, and how to keep posting without training people to tap every button. It is not legal advice and not a complete catalog of every scam. Meta's own help pages describe official contact channels; use those, not a link in a DM. PostToMarket is not affiliated with, endorsed by, or sponsored by Meta. We will not ask you for a Facebook password or login code.

How Phishing Messages That Target Car Dealers on Facebook Usually Arrive

Phishing is a fake request for credentials, codes, or money, dressed as a trusted party. On a dealership floor the trusted party is Facebook, a bank, a "buyer," a vendor, or "the GM on a personal account."

Inside Marketplace and Messenger

• Fake support. "Your listing violates policy, click to appeal." Real enforcement shows up in Facebook's own notices and email, not as a random profile with a generic warning and a shortener link.
• Fake buyer with urgency. "I'm at the bank, send me your login so my wife can see the VIN" is nonsense. "Call this number and give them a code" is worse.
• Account-on-hold theater. Graphics that mimic Facebook UI, often with spelling that is almost right.
• Handoff off Messenger. "Text me at this number to finish verification." The point is to leave the thread you might later show a manager.

Email and SMS that mention Marketplace

Phishing is not only in-app. A text that says your Page will be deleted, with a link, is the same attack. So is an email that looks like a missed 2FA, asking you to "confirm" on a lookalike domain. Treat unexpected links about Facebook the way you treat unexpected links about wiring a vehicle: stop and verify in a channel you initiated.

What they want

• Password
• Two-factor or recovery codes (see never share login codes)
• Remote-access software on a desk PC
• A "small verification charge" or a deposit you are asked to refund (related pattern: overpayment and fake check scams)
• Photo of a driver's license "for Facebook business verification" sent to a stranger

If the message needs any of those, it is not how you post cars.

Common Phishing Messages That Target Car Dealers on Facebook

Treat these as hostile until proven otherwise. Wording will change; the ask does not.

The "Marketplace seller verification" button

Official verification, if Facebook offers it for your account, starts in Facebook settings, not in a DM. A button in chat is a landing page someone else owns.

The "we deposited extra, refund me"

Buyer overpays (or sends a fake screenshot of payment) and wants the difference back. That is a payments scam, often paired with a phishing link "to confirm the refund." Do not refund on a screenshot. Do not log into anything from their link.

The "IT / vendor / PostToMarket needs your Facebook login"

No legitimate vendor of ours needs your Facebook password. Extension sign-in is email for PostToMarket, not a Facebook credential you type into a form we send you in Messenger. If someone claims to be us in a DM, hang up the thread and email info@posttomarket.com from a page you typed yourself, or use contact.

The "GM needs the code, I'm on a new phone"

Social engineering inside the store. Train managers never to ask for codes via Messenger. Train reps never to provide them. Voice plus a known callback to a stored lot number, not a number in the message.

Lookalike Pages and profiles

A profile named "Facebook Marketplace Support" with a generic logo is cheap to create. Badges can be faked in images even when the account has no real verification. Do not trust chrome in a screenshot. Trust the URL you typed.

A Floor Protocol When a Rep Gets a Suspicious Message

Write this on one page. Reps should not invent a response while a customer is at the desk.

If they have not clicked

1. Do not tap the button, call the number, or open the shortened URL.
2. Screenshot the thread.
3. Forward the screenshot to the internet director or GM, not to the group chat of all reps (you do not need twenty people opening the same link).
4. Report the profile using Facebook's in-product reporting.
5. Continue the real buyer threads. Do not let phishing eat the hour.

If they already clicked but did not enter a password

1. Close the tab.
2. Do not go back to "finish."
3. Tell a manager immediately.
4. Change nothing yet unless the page prompted a login you might have auto-filled. If the browser might have filled a password, treat it as a credential incident.

If they entered a password or a code

This is an incident, not a coaching moment for later:

1. From a different device if possible, change the Facebook password.
2. Check 2FA is on; rotate it if the attacker may have added a method.
3. Review sessions and sign out unknown devices.
4. Review Page roles for new admins.
5. Follow unrecognized login alerts: what dealers should do first even if no alert has arrived yet.
6. Notify the GM. Inventory posting from that account pauses until sessions are clean.
7. Tell buyers nothing about "we got hacked" in public comments. Handle internally. If customer data may have been exposed, that is a counsel-and-regulator question, not a blog post.

What never to do

• Do not "test" the link on a dealership PC to see if it looks real.
• Do not argue with the scammer to waste their time; you will still leak information.
• Do not pay a recovery service that DMs you afterward. That is the second wave.

Training That Fits a Sales Meeting

Fifteen minutes, twice a year, plus a reminder when a new scam style hits the market:

• Show one real (redacted) phish and one real Facebook notice side by side. The real one lives in the account's notification area / email you already use with Facebook, not in a cold DM.
• Practice: "I need the login code" → "We don't share codes. I'll call you on the lot line."
• Remind them deposits and wiring have a finance process. Messenger is not it.
• Remind them PostToMarket support is info@posttomarket.com, not a Marketplace chat.

New hires get this on day one, not after they have posting access.

How PostToMarket Automates This

Phishing messages that target car dealers on Facebook succeed when one shared login is the whole store and when reps are scrambling to post from random links. PostToMarket cannot filter Messenger and cannot guarantee nobody will click. It can keep posting on named users and queues so a phished session is one person's freeze, not every rep still using the same password from a DM.

Named users instead of a password collected by a fake form

• Email sign-in, no API keys to paste into a "verification" site.
• Per-rep queues so work is not "whoever has the communal Facebook."
• Roles admin, manager, sales rep, associate.

Pause one person, keep the lot moving

• Team queue view and release claims if you freeze a compromised Facebook session.
• Managers assign units to someone else the same day.
• Server-enforced pacing and one vehicle at a time so "catch up after the incident" is not a burst from a still-dirty account.

Honest inventory while you lock the account down

• Statuses draft, posting, posted, sold, failed.
• Mark as sold and archive so you are not also fighting stale listings during a security event.
• Leads inbox for managers if conversations need a second set of eyes.

We will never ask for your Facebook password in a message. If a "PostToMarket" profile does, it is phishing.

Train the Floor Before the Next Fake Support Chat

Phishing messages that target car dealers on Facebook ask for a click, a password, a code, or a refund. The protocol is stop, screenshot, report, and escalate if credentials moved. Official Facebook work happens in settings and notices you navigate to yourself. Official PostToMarket help happens at info@posttomarket.com or contact.

If one stolen login would halt the whole tower, split access. PostToMarket gives each person a queue, unlimited inventory, AI listing copy, and human-paced posting. Starter is $59 per month for a single login. Dealership is $299 per month for up to 13 logins so you are not one phish away from a dark lot.

Start your 10-day free trial via secure Stripe checkout. Put posting on people you can revoke. Cancel anytime.