And he runs an scr file from an email? Huh

I think we would all agree you have to REALLY let your guard down to accidentally open a file like that.

But you would be surprised how much you drop your defenses when you are convinced you just got an email from a friend/business partner/etc.

I know a not-incompetent technology director who bought a gift card and sent the number to a scammer, because the scammer had hacked their coworker's email address, so the request came from a legit address.