Most of the time you use “whom” as the object of a verb, and “who” as the subject of a verb. However, there is a special case when this is not true.
I was asked the following grammar questions:
Which of the following is correct?
“We are not who we have been”
“We are not whom we have been”
“I am not who I will be.”
“I am not whom I will be.”
This is certainly a tricky situation. Although it appears “whom” is correct because it is not the subject of the clause—it is the object of the verb “are”—in this case we use “who.” The reason is that following forms of the verb “to be” we use the nominative (subject) case. I have some discussion of this on my grammar help page on pronouns. http://www.hgpublishing.com/Grammar/Pronouns.html
This is the same rule that makes it correct, when you are asked for by name on the phone, to answer “this is he” (or “this is she.”)