Yes, it's possible. In fact, there are many people who fell for such scam tactics.
But what they actually they do are modifying unencrypted part of the wallet.dat to show address which doesn't have it's private key pair.
recently someone is selling fake bitcoin wallet.dat file containing 3050 BTC (
https://www.blockchain.com/en/btc/address/1Lg5pJRaWKw6n2J4CBjoEJY5ZdLwBu21U2)
that wallet is my friend wallet and he immediately moved all bitcoin to different address.
scammer send small amount of btc in all such cold wallet and check if wallet is active or not,
if wallet is inactive then they create fake wallet.dat file and fool other