The attack mode in this case revolved around the use of a client system to tell HR/Payroll where to pay the money. We don't do that, any change in bank account details is a visit to an office with paperwork.
It wasn't his banking account being phished, you should read the linked articles before commenting on things.
Doesn't always come down to technology.
In fact, when it comes to technology it's usually pretty good. Humans on the other hand always err on the side of incompetence as there's usually someone else to blame...
If you do not believe this about humans, work in or for the public sector in the UK for a bit!
Chunk of cash suddenly appearing in my bank account would have me asking questions by the way.
I imagine bank security in the case of the unwitting recipient of your wages were reassured by the payment coming from a BACS or similar system. When I paid my redundancy cheque into my bank account over the counter, a bank manager appeared in seconds and wanted to know why this very large amount was being paid in...