>ultimately seized control over the account by convincing him to click “yes” to a Google [2FA] prompt on his mobile device

Stopped reading there. What more can we do to protect people from their own stupidity (and I'm not talking about the crypto "investment" part)?