He mostly used social engineering. Not technical exploits. So that's how he succeeded. Call it crazy, but it worked.
Bold of them to assume I'll answer the phone if I see my manager's number come up.
If I've learned anything from the scambait people such as kitboga on youtube, if you're bored you play along with it, pretend to have acquired the gift cards, and then tell the "boss" you've scratched off and emailed their company address the codes, as the scammer on the phone wails "do not redeem! SIR DO NOT REDEEM!"