Hello!
Ok, ok, I'll start by saying that he wasn't my friend, but my brother's friend, actually.
He plays WoW, aswell, but he have never leveled his own character / toon, and therefore I gave him a huge punishment.
Although, he had a level 70 Gnome Warlock on Magtheridon and he thought he was so great and good...
So! Let's start!
Before you start the scam, you'll need to download a keylogger. A keylogger is originally designed to give security for worried parent's children. It blogs absolutely EVERYTHING that happens on your computer.
Now, remember to not just ask immediately when your friend comes by. Make him play on your brother's computer or such, and do wait for about 20-30 minutes before asking him.
In my case he was playing WoW with my brother, so it was quite easy.
Now, have patience - if you start the scam too soon, he'll notice. Now start your computer and start running WoW. Stay at the login-screen. Now, get off your chair or whatever you're sitting on and ask your friend if you can check out his level 70 Gnome Warlock, because you think his character is so unamazingly cool and awesome.
He will normally accept to write his account name and password. Just don't look! Let the Keylogger handle that.
Now, just play for a while and have fun on your friend's account / character. And when your friend leaves, go check the Keylogger.
Check the blog, and the username and password will be located there!
Now logon to your friend's account, and scam as much as you wish!
Personally I took all his money and got him kicked out from his guild, which was a quite good guild.
What did I do with all his money? 600 G? I spent 20 G on twink, before I got bored and migrated to my own, main server / realm and sent the remaining 580 G to my main character.
Good luck!
P.S: I'm evil.