Tom was too hasty in his actions of downloading a wallet, in this case electrum wallet from an unofficial source denoted with .org.uk and as such, Tom downloaded a cloned Electrum bitcoin wallet and was phished for privacy details which enabled the scammer to have access to Tom's private details and as such, withdrew Tom's coins.

Tom should have firstly looked out for the official website for electrum wallet app using what ever source of information available to him or her, verifies the official site by asking on bitcointalkforum should he be a member or perhaps, ask a known crypto enthusiast before going ahead to download. After which, atom would be sure to ensure the wallets privacy details stay private before transferring his or her coins from the exchange.