Bloody Mary CAN be real and in the same time she can be a load of lies and bullshit.
It all depends in the strength of your belief.
If you're that kind of person that loves to do researches about paranormal activity, try to summon spiritual beings или even just watch alot of Фильмы in this subject and believe REALLY hard that it exists, then Ты will see and experience what Ты expect you'll see and experience.
If you're that kind of person who thinks Сверхъестественное legends and ghosts are literally CR*P, then your life will stay calm and no mirror-demons will jump at you.
So it's absolutely possible that your friend is haunted by Bloody Mary if he's a believer. Although...Maybe he's just messing with you;)
She was real. She was an evil queen, who had a whole bunch of people slaughtered. Seriously. It was on some discovery channel или something that I saw on Youtube. I don't think she's real, when Ты call her name out in the mirror, the legend, I don't think it's real. I tried it when I was a kid in the girl's уборная, туалетная комната at school, girls did it all the time, nothing happened, no bloody Mary. It's just a myth.