I was checking my Facebook messages from my family when I noticed that he had shared a post sent to him on his Facebook account.
It appeared to be from Tesco offering a free £50 voucher by clicking on a link to a website page to make your claim. An obvious scam. I asked him if he had clicked on it. He said he had.
I am now running a full virus scan on the laptop and hoping he hasn't caused any lasting damage.