Seems like it was a site phishing prompting him to call the number when (obviously) unable to log in.