Z clicked the first link without verification
All options could be correct to some extent. However, in this case Z most likely blindly trusted the first link shown by the search engine and made a purchase from a scam website.
Search engine results should not be blindly trusted, specially the ones that appear on top and / or are Sponsored. It is possible that a malicious actor is running ads for a scam link on high hitting keywords.