It seems he has a clipboard hijacking malware on his device. It's always important to cross-check the copied address, even after pasting it in the required field.
The address that received the funds has been reported as fraudulent, 11 times on bitcoinwhoswho

Also advise him that Blockchain wallet is not the best kind of wallet to use.