The difference between who and whom is so simple that we don't really need to know the grammar behind it, but I'm going to explain the grammar anyway, cause then you'll know why to write who or whom. Who belongs to nouns and pronouns of the subjective case, meaning they are the subject of the sentence. Here are the subjective pronouns: I, you, he, she, it, we, you (plural), they. With these, you shall use who. Pronouns or nouns that act as objects are in the objective case, and the following is the list of objective pronouns: Me, you, him, her, it, us, you (plural), them. These use whom.
There's a trick to figuring these out: remove who or whom and replace it with one of the above pronouns. Let's see some examples:
Incorrect: Who can I trust? (I can trust he? No. I can trust him? Yes.)
Correct: Whom can I trust?
Incorrect: Whom bought the groceries? (Him bought the groceries? Yuck. He bought the groceries? Perfect.)
Correct: Who bought the groceries?
Incorrect: For who the bell tolls. (The bell tolls for he? Incorrect. The bell tolls for him? Thanks, Hemingway.)
Correct: For whom the bell tolls.
Two notes: When in doubt, use who. It's always better to sound casual and be wrong than be an incorrect elitist. Whom are you? sounds stupid, while Who are we looking for? sounds colloquial. Both are wrong, but the second draws less attention.
Sometimes people write phrases like, The man that came over . . . . Such phrases are wrong, because that does not go with people. Always use who or whom with people: The man who came over . . . .