Look at the email image in the lower portion of the article. All the attacker needed to know was the accounts-payable email address for MacEwan, the true accoun

Look at the email image in the lower portion of the article. All the attacker needed to know was the accounts-payable email address for MacEwan, the true accounts-receivable address for the builder, a reasonably similar domain (.com -> .us) for spoofing, and a convincing email body. That is a frighteningly easy bar to clear, so it's reasonable to say this was human error more than a problem with information security.