Before accepting a loan I see a few things about them:
#Trust
# recent merit
# recent post
# Signature campaign.
But the user has failed all of these as the user woke up recently. Who knows if the account has been sold or not?  However, the possibility of being hacked is too low as the user had not created any post regarding the hack.