But the overall conclusion is very likely right (in my view).

Right answer, somewhat off on the reasoning, in my opinion. Assuming the OP is in the U.S., then the law of her state probably provides that life insurance usually does not become part of the calculation of the assets and debts of the deceased's estate, but instead goes directly to the beneficiary. (I say "probably" because since this is a legal question the OP would need to talk to a lawyer in her jurisdiction about it to get a decisive answer, and because since we don't know the particular state the asker is in we can only talk about the most commonly applicable rule.)

"Individual offering a 3% loan, any amount, any length of repay time...." You could stop right there, really. Scam. With 100%, absolute certainty. To say the least, no legitimate, remotely sane lender would ever offer terms like that to ordinary individuals (or ordinary mega-corporations or ordinary large governments, for that matter). If you like, you can continue on and consider the implausibility of the no collateral, no credit check, etc., elements of the proposal. But really...in this case you can be entirely sure this is a fraud after having put in only a very small bit of thought.

(Admittedly, identity theft isn't quite the same situation as a legitimately-created account being abused by someone who steals card info. But oftentimes the degree of scrutiny a bank applies will be similar. Especially where the fraud actor has managed to charge a sizable money amount worth of purchases to the card.)

"Although you shouldn't end up out any money when this happens, it is an inconvenience." Yes, and banks often have a lot of say about how much of an "inconvenience" they can make it to get charges waived as fraudulent. I've helped identity theft victims deal with some banks that were (a little surprisingly) satisfied with a phone conversation with the fraud department and a signature on a follow-up document, and other banks in a few cases that sent multiple lists of written questions, wanted photocopies of all sorts of documents, demanded handwriting samples, etc. Not always a simple process.

I really don't mean to be indelicate, but...this person may not be your friend. At least, not anymore. Either (1) he actually knows full well this is a scam and his intent is to make money from others then get out before the whole thing is exposed or collapses, or (2) he's become so emotionally invested in this being a legitimate, honest thing that's going to improve his life that there may not be a lot more you can try to get him to see the truth. If it is the latter,it's--sadly--quite possible that he will reject any/all attempts to show him it's a scam until after it fails in the end.

A very salient point. The only thing worse than being scammed out of a large sum of money that you owe a bank eager to collect it is to get a knock on your door one morning and find a number of serious-faced federal agents there to inform you that you'll need to come with them because they think you're guilty of wire fraud, conspiracy to commit money laundering, and god knows what else.

"The biggest security risk with the new cards is that many vendors don't actually require use of the chip at all -- they still let you swipe." This. The day that new payment cards in the U.S. no longer come with magnetic stripes in the first place will be a great day for financial information security.

Because even if a retailer does (improperly) implement "chip + nothing" for EMV card use vs.mag stripe + signature for old cards the "signature" step is functionally equivalent to "nothing" in almost all cases. Nobody ever bothers to check to see if there's a signature on a card, let alone compares that to the signature the purchaser gives, let alone declines a transaction because the two don't seem to match sufficiently. So, even where a store stops requiring signatures you pit the (not perfect, but still significant) benefits that come with chip usage against little-to-no practical loss.

@supercat I don't think I'd necessarily have any problem with something like that. If there were a scenario where it was more convenient for a customer & merchant to authorize that limited amount of time beforehand instead of at the point where it typically is that would seem alright to me. I guess it's possible there's some issue I'm not thinking of at the moment, but off-the-cuff, wouldn't have any big issue with it.

One note: I should not have implied that in a case with a compromised card reader that the card reader could not change the amount of the transaction vs. what you believe you are paying at the sales counter. The card has to "sign" the real amount that's being authorized, but as it has no screen (yet, anyway) you can't see and compare that amount to what the store's equipment is telling you. Such fraud would be easily and specifically tied to that retailer and that transaction

EMV is implemented each transaction must be digitally signed by the chip in the card and a unique cryptogram sent off to the payment processor for the processor to authorize the transaction. Thus, even in the worst case where you have a totally-compromised card terminal the card terminal captures no information that could be used in replay attacks to make other, future transactions. Which is a world of difference vs. magnetic stripe transactions.

@supercat The goal of EMV is to prevent what security professions call replay attacks; cases where a bad guy is able to steal your static payment information during a transaction and then later use that during other transactions that you haven't consented to.. To do that you need some kind of authentication feature that actually changes from one transaction to the next. Its the same kind of general idea that one-time codes and pins operate on when you use two-factor authentication to login to certain websites. Thus the idea has gotten the name "dynamic authentication". Moreover, the way...

@jpmc26 That's quite true, and a good thing to point out. Actually, if a proposal were to come forward to transfer credit and debit card regulation to the federal government and out of the industry self-regulating model that PCI represents I really don't know whether I'd personallysupport it: I think PCI has made some rather substantial errors obviously, but OTOH I would be concerned about whether we were just trading private regulatory problems for a set of different kind of problems that come with/from government regulation. I would have to think a lot more about that choice...

@supercat I understand what you're saying, and obviously anybody would prefer a faster, cleaner process vs.a slower, less efficient process. But the old magnetic stripe way of doing transactions is just inherently & totally insecure. You need a way of doing transactions where even if every piece of equipment a merchant has has been subverted to maliciously steal your card info, even the reader itself, a bad guy can't take information from your card and make a working counterfeit of it. A chip can do that --via something called dynamic authentication--where a magnetic stripe just can't.

@Josef But I honestly don't think it will have such dramatic impact here, from a legal standpoint. It's true that because it would take a very sophisticated attacker to counterfeit the chip & the info contained inside and steal the pin then in certain scenarios demonstrating fraud would become harder. But not impossible. The legal statutes here in the U.S. that protect consumers don't exclude chip-card transactions from their protections. Moreover, judging by the record that EMV has had in the rest of the world actual counterfeiting & abuse of a chip-card would likely be extremely rare.