There's a trick to figuring these out: remove who or whom and replace it with one of the above pronouns. Let's see some examples:
Incorrect: Who can I trust? (I can trust he? No. I can trust him? Yes.)
Correct: Whom can I trust?
Correct: Who bought the groceries?
Incorrect: For who the bell tolls. (The bell tolls for he? Incorrect. The bell tolls for him? Thanks, Hemingway.)
Correct: For whom the bell tolls.
Two notes: When in doubt, use who. It's always better to sound casual and be wrong than be an incorrect elitist. Whom are you? sounds stupid, while Who are we looking for? sounds colloquial. Both are wrong, but the second draws less attention.
Sometimes people write phrases like, The man that came over . . . . Such phrases are wrong, because that does not go with people. Always use who or whom with people: The man who came over . . . .