Yeah this looks like a phishing attack. But where is the fake Coinbase site at? Or he never accessed a fake site and it was just him calling a phone number and telling them his password and user?
it sounds like there probably wasn't a fake website set up, and that he just gave all his information to them out of desperation and belief that he was on the phone with coinbase support. it's still not clear. but if they set up a fake phone number, it's not difficult to see them setting up a fake website. it could have been set up as a simple support portal (e.g. with zendesk or kayako), like some exchanges have been known to do.
If there was a phone call then he could ask the police to look it up. Phone calls are not that easy to make anonymously, maybe there is a case here.
it's pretty easy these days. i can mosey on over to the services or digital goods forums and get some phone numbers set up right now, paid for with bitcoin. burners/sim cards in mail if nothing better -- difficult case to pursue across borders for this amount of money.
Also he must have gotten the fake phone umber from somewhere, so where is the website that listed the fake phone number?
apparently it was listed on google.
lesson learned: you should never give passwords/secret tokens to customer support people. exchanges will never ask for this. these are always social engineering attacks.