'Send me a BLIK code': Facebook account takeovers

You get a Messenger message from a friend: “Hey, got a sec? My BLIK is blocked, can you send me a code? I’ll pay you back tonight.” You’re chatting with the real account of a real person — except a criminal is sitting on the other side. It’s one of the most effective scenarios of 2026, because it exploits trust that technology can’t protect.

Where the hijacked account comes from

Before the request for a code, the criminal has to take over someone’s account. The most common routes:

• Login phishing — a fake Facebook login panel (a link: “see who viewed your profile”, “your account will be deleted”).
• Email takeover of the address tied to the account, and through it a password reset.
• Leaked passwords reused across services (credential stuffing).

Once taken over, the account becomes a tool for attacking the friends list — because a message from a known person carries enormous credibility.

Do not assume a single entry vector. Beyond phishing and password reuse, an attacker may steal an active session, abuse account recovery or compromise the associated mailbox. Changing only the Facebook password is therefore insufficient after an incident: secure email, terminate unfamiliar sessions and review recovery details as well.

The two most common variants

The BLIK code. The “friend” asks for a BLIK code under the pretext of a temporary problem. The code you provide is instantly cashed out by the criminal at an ATM or in a shop — and you lose money with no transfer to trace.

The ID scan and loan. A nastier variant: the hijacked account asks for a photo of your ID “for verification”, or pushes you toward a “quick loan just for a moment”. An ID scan is material for opening accounts and defrauding loans in your name. Niebezpiecznik has reported cases where victims only realised after a tip from another friend.

How to tell it isn’t your friend

• An unusual request for money, a BLIK code or documents — even if the “real” account is writing.
• A change in writing style, odd typos, avoidance of a voice call.
• Pressure and secrecy (“just don’t call, I’m in a meeting”).

The golden rule: verify through another channel. Call your friend or send a text. One question asked out loud defuses the whole attack.

A BLIK code does not complete a transaction on its own: the banking app displays an approval request. This is the final opportunity to inspect the amount and operation type. Never approve a payment you did not initiate, even when the sender knows personal details about your friend. A compromised profile exposes posts and sometimes conversation history, so a correct answer to a simple challenge does not necessarily establish identity.

How to secure yourself

Turn on two-factor authentication (2FA) on Facebook and on your email account — ideally via an authenticator app, not SMS. Use unique passwords (a password manager is essential today), check active sessions and devices in your security settings, and add a second recovery email to the account.

And most importantly — never, under any pretext, give a BLIK code or an ID scan in response to a chat request. A BLIK code exists solely so that you can pay. It’s the same lesson as with phishing: the most effective attacks target the human, not the system.

Recovering a compromised account

Use Meta’s official recovery process by entering facebook.com/hacked yourself, not a link received in a message. From a trusted device, change the Facebook and associated email passwords, terminate other sessions, remove unfamiliar MFA methods and inspect recovery addresses and phone numbers. If the account manages company pages or advertising, review administrator roles, payment methods and newly created campaigns.

Warn contacts through another channel. Preserve chat screenshots, transaction identifiers and event times. If you approved a payment, notify the bank immediately and report the crime; do not wait for the attacker to reply. In a business, a social-account takeover belongs in the normal incident process because a browser session or compromised mailbox may also unlock other services.

The minimum for a company profile

Use named individual accounts rather than one shared login, least-privilege roles, MFA for every administrator and periodic access reviews. Store recovery codes away from the device and define who will contact Meta and the bank. A rehearsed recovery is more useful than a procedure nobody has opened.

Managing company social media profiles? We help roll out MFA and access-recovery procedures as part of our security services for businesses — and if an account has been taken over, contact us.

Sources: Meta — compromised-account recovery, Meta — Security Checkup, CERT Polska — 2025 annual report.