Without a proper explanation as to why he even wants to attempt this, why would you give him any clues on how to do it? I am certain what he is trying to accomplish is capturing credentials, which no user will agree to. IF he put, above the user credential form on his website, "user credentials will be copied into paypal for your convinience", no user in their right mind would allow him to do this and is a serious security risk.

Maybe allowing him to explain WHY he is doing it before telling him HOW, would be a better path.