It's not phishing if he didn't fill in his details on a fake paypal form or email. Most likely a trojan likewhat happened to me.
Never said it was paypals fault. I love their services. I'm using NOD32 for antivirus and spysweeper for antispyware