Amazon has bad actors inside and outside.
A classic fake supplier, fake invoice fraud. Nothing innovative, just a breakdown in governance and segregation of duties.
Unclear from the article if the main perpetrator was overly privileged in systems access (allowed to create suppliers and submit/approve invoices) or if a multi person conspiracy was required to enter the data into the system (paying multiple persons to reduce the likelihood of detection).
Fraudsters are eventually found out for sure. Big company is going to have some internal bad actors.
These types of problems are usually “Day 1” problems which then get controls and become “Day 2” problems for the company as it corrects in the other direction. i.e. – no one can procure anything without an audit and a committee decision.