If I remember correctly this fraud was only done after they got acquired. The company's sales/marketing dept asked the newly acquired startup for a customer list to hit up, which is when the founder generated one after being asked repeatedly for it.

Which is when they were caught, emails bounced and they noticed the excel sheet rows matched the total limit in Excel.

So apparently the M&A team trusted the startup was successful when purchasing without seeing the customer list. Most startups get reputation through their press + fancy VC backers giving social credit + a good slide deck, which apparently was enough.