Your bank will never ask you for your app or account password
This sentence alone would have been enough to stop everything we are about to recount in this report, had anyone who fell victim to the fraud read it at the right moment.
The Tahaqaq team identified a Facebook page bearing the name and logo of one of Libya’s banks, whose advertisements were being funded to reach a wide audience that did not even follow the page. The page does more than impersonate the bank. Advertisement after advertisement, it builds an entire experience that resembles dealing with the real bank, until it brings the victim to the point it wants: entering the username and password for their bank account, their phone number, and eventually the OTP verification code.
What a page that “resembles” a real bank looks like
During its examination and monitoring, the Tahaqaq team documented one fraudulent page using the logo of a Libyan bank and advertising content to lure the bank’s customers. None of these indicators alone is sufficient to judge whether the page is official or unofficial. But when transparency data—such as when it was created, its number of followers, the number of advertisements, and the content of those advertisements—are examined alongside the links used and the type of data requested from visitors, an entirely different picture emerges. In most cases we monitor, this leads to requests for highly sensitive banking information, such as card details and phone numbers, as well as instructions to unlink a particular banking app and procedures that result in the customer losing control of their digital bank account.
Two paths, one ending
The team identified two main paths taken by the page’s advertisements.
The first path presents itself as “customer service.” The user clicks on the advertisement and is taken directly to a Messenger conversation that begins in a friendly style resembling official support, with questions such as: What is your problem? Do you want to reserve dollars? Are you having trouble with the app? … But the conversation quickly turns into a request for the phone number linked to the account and the bank account number, under the guise of “providing assistance and resolving the problem.”
The second path is more enticing and interactive because it exploits a genuine public need and promotes access to a service—most notably reserving foreign currency, applying for a loan, or winning a prize. Clicking on this advertisement does not take the user to the official website, but to a fake site bearing the bank’s name and logo. It reproduces an interface very close to that of real banking services, generated and copied using artificial-intelligence tools for website creation. When the user selects “Reserve dollars” or “Apply for a loan,” a form appears requesting their full name, phone number, account number, and bank branch.
Here, the fraudster has not obtained an isolated piece of information, but rather a linked package of data that makes it possible to build an accurate profile directly connecting the victim’s personal identity to their bank account.
Then comes the decisive step. After completing the form and clicking “Complete the request,” no real transaction takes place. The user is redirected to a page claiming that they must “unlink” their account from the original banking app or “relink” it to another service—then they are asked to enter the username and password for their real banking app, along with the verification code.
The same scenario is repeated exactly with the loan service. The interface changes, but the destination is the same. This similarity between two seemingly different paths reveals one truth: “reserving dollars,” “loans,” and “customer service” are not three separate services, but three doors that all open into the same room: the theft of bank accounts.
Why do they use this trap?
The answer lies in the way we think
The fraudsters here are not betting on people’s ignorance. They are betting on the fact that our minds are programmed to look for shortcuts and convenience, not absolute certainty, in every decision we make each day—especially when everything appears professional.
Need silences caution and thought. The process of reserving foreign currency in Libya may be unfamiliar to many, and the need to reserve dollars or obtain a loan is a genuine need that no one has invented. When someone finds an advertisement promising a direct solution to a problem they actually face, such as reserving dollars, the question “Is this real?” automatically gives way to a more urgent one: “How can I get this now and benefit from the difference?”
The logo replaces thinking. When the brain sees a familiar logo and recognizable visual identity, it uses a simple cognitive shortcut: “This resembles what I know, therefore it is trustworthy.” This shortcut is useful in our daily lives, but it is precisely what someone carefully designing a fake interface exploits.
Each small step paves the way for the next. No one is initially asked to hand over their password. They are first asked for their name, then their phone number, then their account number, and then encouraged to click “Complete the request.” After investing time and providing data, backing out at the final stage becomes psychologically harder than continuing—and this is the same vulnerability exploited by every scam: the further you progress through the process, the more reasonable continuing seems compared with stopping.
A paid advertisement lends credibility it does not deserve. Many people assume that Facebook “reviews” advertisements before publishing them, so they treat the appearance of content as a sponsored advertisement as an additional guarantee of credibility. This is precisely what makes sponsored advertisements more dangerous than ordinary posts: they do not wait for someone to find them by chance, but are pushed directly into the timeline where users are accustomed to seeing advertisements from real companies and services on their app interface.
Prevention indicators and avoiding the trap of fraud
All the details above come together around one simple fact: no bank asks its customer for their username, password, or the verification code for their banking app through a Messenger or WhatsApp conversation, or through a form on an unknown website that has not been published on the bank’s official accounts and communication channels. Nor does a bank provide any services related to reserving foreign currency, which is exclusively handled through the Central Bank of Libya’s system. Therefore, any foreign-currency reservation carried out through links to banking websites is invalid.
Any entity that asks you for this data under any pretext should immediately be treated as a potential threat. Stop the process at once and verify the matter solely through the bank’s official channels—not through the link that brought you to the page in the first place.
Fighting the fake page alone is no longer enough
Deleting a fraudulent page after discovering it is no longer sufficient to stop this type of fraud, because the page is only one link in a longer chain: a sponsored advertisement, an impersonated visual identity, a genuine service people need, and a conversation or website that imitates official channels and uses their logo, ultimately leading to the collection of sensitive data. The real challenge facing banks and verification teams alike is now to monitor this entire chain, not just one link in it—especially since fraudsters have begun launching several pages at the same time in a large and rapid campaign, all of which lead to the same fraudulent link used to steal the banking data of victims lured from Facebook.
A fraudster does not need every stage of their scheme to be perfect. It is enough for each step, on its own, to appear logical enough to push you toward the next one—so they can steal from you while convincing you that everything is normal.
Verify before you engage
