ifIf they did not give a credit card and did not receive the file, there should not be a significant reason for concern. I would have them run virus scan and malware detection and remove anything found.
inIn the US, the Federal Trade Commission put together a non-techie page about these types of scans an youscams. You might direct your friend there just for some further knowledge.
itIt never hurts to be over protective if you think anything might have occurred. itIt is all about the level of comfort the person has after the fact that their computer data is still intact.