I know a guy who was fired from a job in 2023.

When he was rehired years later, they asked for a reference from his previous job, where he had been fired. He said he was fired.
He registered a similar domain, created an email that mimicked that of a former boss. He gave it to them and then provided his own reference when they contacted that email.
They never caught him.
Do you think he did the right thing?