There's no social engineering here, since all they have to do is copy and paste. This is a complete process design fail.