They both need question marks. "Whom" is formally correct but can sound stilted or pedantic in ordinary conversation. "Who" is commonly used in place of "whom" in everyday English.
New words, one handy idiom, and a 2-minute quiz — delivered to your inbox to keep your streak alive.