The odds that some random WiFi was doing SSL MITM attacks to facilitate the type of scam mentioned in the original thread is near zero.

It is much much more likely it was another case of nearly identical domain name that the scammer owned and the person never noticed.