If the e-mail has a telephone number tell him to check the telephone numbers of the actual company (using the web and not using any links that the e-mail may provide) against those given in the e-mail.
The probablity is that they have created a look-a-like site that looks genuine.
Had a few myself some months back and reported them to the genuine company.