Where I work spear-phishing is a real concern, so they have instituted a training program where they send fake phishing emails every now and then. If you fall for it, you are directed to a training page. If you spot it and click the "report" button, you are greeted with a message congratulating you for being on the ball.

Perhaps some training is in order. You may not have the means to simulate a scam from his favorite "adult" website, but perhaps you could do something with a throwaway email account, or maybe simulate collateral damage from a successful scam.

And yes, you need to insulate your respective financial lives from that risk ASAP