Above all the issues about Jezza being a tad naive and all that, I think it does raise a fundamental issue about how insecure electronic banking is.
I’m presuming that the ‘fake’ direct debit was set up online. In the old days, it would have required a signature - so the bank should have easily spotted a fradulent one.

Without that papertrail, things are nowhere near as safe…

He certainly shouldn’t ask for the money back, and I very much doubt that he will.