@atikovi - Here is what happened.
He applied for a summer internship to his college. My son got email (s) from his college professor with professor name and college domain, so he never suspected. When all was evident to be a fraud, my son realized that college email software / network (or whatever…) was compromised. But to your point, there is no excuse for my son not to use common sense. looks like he has to swallow this bitter pill as growing pains - sad-.