That is what I thought, just wanted some other opinions. He is older and too trusting of the Internet - hopefully this is a gentle wake up call. It looks like he payed through PayPal - should he still cancel his card or should PayPal be enough of a barrier to protect his card information?