That's odd. The author defends his "backdoor reference checks" by saying he would have never caught the catfish otherwise. Then later on the same person he contacted for his "backdoor reference check" was given to him as a reference, which would have happened regardless.
Yes, but they might have naively used the given number rather than the number they personally had, out of convenience, which would have caused the catfish to succeed.
But no, the author knew Jim, if he had dialed that number and did a bit of small talk he would've known that's not Jim on the phone (unless the fake Jim is quick on his feet about pretending to be someone else).
The catfisher is stupid, he should've looked through the author's LinkedIn profile and saw that the author is connected with Jim, he would have not used Jim as a reference if he had done that.
You can't just fake a corporate email address. And even phone numbers for offices are usually all in one block, you can verify if that belongs to the company.