Nothing against your dad I'm dealing with a similar situation right now as well, but there are several active steps to being scammed this way. I have also clicked suspicious links but then spent the next half hour trying to figure out if it's legit before moving forward.

Banks and credit card corps should be legally required to provide education to card holders AND restrict online access if the card holder can not demonstrate that they understood the information. It is not unreasonable for people to check a URL and recognize a fake financial login page after they have been shown how.

But the web has been treated like a toy, there is no education about it's safe use in schools and businesses would very much prefer that you and I know as little as possible about how it works. Lack of education is the underlying issue, your dad, like most people, probably doesn't look at the address bar or check SSL certs because that kind if thing is "tech stuff." But the web has been in everyone's pocket for almost 20 years, no one can say that it's too complicated or not important to learn how to be safe.

It is thankfully becoming more rare. But I have frequently seen some hostile behaviour.

1. Not marking password fields as such so that they don't get filled.
2. Blocking pasting into login fields.
3. Requiring using some sort of on-screen keyboard to enter your password (or more often PIN).
4. Requiring enter some characters of your password rather than the full thing. (ex please enter characters 1, 8, 2, 4 of your password).