The first thing I would do is clarify what they're asking. This may be obvious to you based on the conversation you've already had. If I was curious about a shopper's work and I asked who they work for, my question would mean "Who is the client?", not "Who is the MSC?"
The second thing I would do is clarify that I'm a little hurt they are trying to steal work from me, right to my face. Don't be subtle, because they might not get it. And don't be rude, because then they'll feel like the victim. There aren't that many shops and they aren't that well paying, so what are you trying to do to me?
But after that if they are a friend, I'd tell them whatever is the most obvious. Bestmark happens to top Google right now. And I haven't done a shop for them in ages, so knock yourself out. There are also SecretShopper on the first page of results, proving that SEO is a different skill than getting clients. That way you're giving honest information but also demonstrating that the opportunities aren't as flush as one might hope.