To be honest, the box of adult toys and their specs was not worth the trouble…….

* First time that you have been made aware of. Even just this individual, could have been doing it for years. And there could be others.

Bulky reflection beyond this point. TL;DR'ers beware.
–
I've been part informally, part formally studying the technical, social and psychology aspects of social engineering ((spear)phishing in particular), for several years. I certainly don't mean to rain on anyone's parade, but I'd be very surprised if somehow this was the very first attempt at this kind of impersonative spearphishing, and as such, that very first one was the one to "get caught". Especially considering that, as you pointed out, this individual/entity succeeded. Meaning this didn't raise any eyebrows until doing so at a later time. More than likely not until the correspondance and fulfillment of the request, was (incidentally) discovered by a 3rd party.

In most of such cases, there won't be any second thoughts about this stuff. In the vast majority of (spear)phishing attempts, either it's flagged and/or treated as suspicious before commencing further dialogue or fulfilling the impersonator's request – or it's never flagged at all. Unless the request made or instruction given would be highly unusual regardless of legitimacy, there's usually no process in place for pre-screening and post process evaluation. There' simply not capacity for a 3rd party to be going through every bit of correspondence, so companies rely on employees using their judgement and reporting themselves, and some times automatic flagging of correspondance that particulary stand out in ways detectable by software filters. If the incoming(!) correspondance isn't identified as substantially unusual, it all rests on the corresponding employee's judgement. Some companies might flag outgoing correspondance for post evaluation, or do randomized spot checks. But it's exceedingly rare to actually halt outgoing correspondance for manual vetting before releasing it. Those doing such manual checks are usually backlogged, and outgoing correspondance is often time sensitive. But individuals doing such manual vetting, wouldn't be able to know that until they actually get to it, and even then they cannot know the full context of every piece of correspondance, even from reviewing it's content.

If at first the recipient has decided to oblige the request, they've already "whitelisted" the other corresponent and their request in their mind. Beyond that point, it's quite rare for that to change, unless a 3rd party of different perception gets involved. And even then, that 3rd party often has to contend with the first corrspondent's defense of their own judgement, conclusions and actions. Because concluding and admitting they potentially got fooled and tricked into doing something, is not only gonna hurt their ego, it could spell a recognition of having caused potentially quite severe harm by poor judgement. Depending on the situation, that could mean some quite substantial liability.

This is one of the primary reasons why people getting catfished, duped and milked for resources and favor, will often continue to go along for a really long while – after either someone else points out that they're likely being fooled and scammed, or they have their own initial suspicions. They often get really defensive, and reach for all kinds of defenses and explanations for why that which should be ringing their alarm bells, is Really OK in "this one instance". Personally I've experienced friends whom have been really well informed and rarional about these things, pointing out, explaining and helping others that were getting scammed in such ways – fall into the same traps themselves, and exclaim the very same kinds defenses and justifications for themselves. Even knowing through demonstration abd action, that they really do know better, including having a good understanding of why people do those things, and a firm ability to identify those in others.

Why? Because egos and feelings are fragile things, especially when it comes to admitting you have been fooled, including to yourself. People are quite inconcistant creatures, and far too many execute by unintentional "do as I say, not as I do" mentality .

OK!

Can I impersonate you to find out confidential information about SOLAR ROADWAYS??

well… it is your fault for using your gmail account as a bussiness one. You have a domain, just use any of the cloud providers to have your own email server for your domain. How can you use a gmail account for business ?

What????Dave Jones is an impersonator???

And anyone cares? 🤷‍♂️

Surely more embarrassing for the company that fell for it, if they actually gave out anything remotely "not for release"?

Sophisticated spam. Another Chi-com dirty trick!!!

That is identity theft is certain places and is a crime punishable under the law.