Wow, glad you caught that before it became serious. Crazy stuff.
Yea, he applied on LinkedIn. Several red flags to me. Initially
-Too high of salary
-I was expecting the initial questionnaire to be a prescreening, they answered with an offer without a phone conversation.
More red flags after looking them up,
-They used a legitimate company, but created a “company”careers.com domain , I looked it up, it was created 2 days ago in Canada.
-I went to the legitimate company LinkedIn site and they posted a warning about someone posing as them, so they already knew.
-wording in the email sounded wrong like you see in scams
-their email had no phone number to contact them.
-email did not have the company logo
I want him to lead them on and see what they ask for next. I expect they will want bank info to set up direct deposit, and of course SSN.
Fortunately he hasn’t even given them his address.
Right now they want him to send Full name, address, phone number and email address “so that HR can register you”.

(They already have 3 of the 4)