Even Al-Qaeda sometimes managed to use fake passports in the West...
Ahmed Ressam, the focus of this FRONTLINE report, was somewhat of an expert in fake passports. He used a counterfeit French passport to enter Canada and apply for political asylum. While living there, he supplied fake Canadian passports to other Algerians. And he used a fake Canadian passport under the alias of Benni Noris in his failed attempt to enter the United States and bomb Los Angeles International Airport.
... so no big surprise that a government agency of a country with 2nd largest economy in the world managed this.
(Forged Canadian passports were also used by Mossad to carry out some missions, but in the more distant past.)
Also Iran managed this
The peculiarity of this missing flight was compounded by the identity of two of its passengers: Italian Luigi Maraldi and Austrian Christian Kozel— two men whose passports were on board even though they were not.
Instead, two Iranian nationals fraudulently used their stolen passports, both of which were lost in Thailand, to board the flight.
As for how this possible: lax enforcement, basically.
In theory, authorities should be able to cut down on passport fraud fairly easily during their standard security screening process.
Interpol’s Stolen and Lost Travel Documents (SLTD) database, which was created after the 9/11 attacks, lists more than 40 million lost or stolen passports, identity documents, and visas. In 2013 the database, which has entries from more than 160 countries, was searched more than 800 million times and yielded 67,000 positive hits.
However, according to U.S. News & World Report, Interpol Secretary General Ronald Noble said that “only a handful of countries worldwide are taking care to make sure that persons possessing stolen passports are not boarding international flights.”
According to Interpol, member states say a lack of police resources, privacy concerns, and politics accounts for their failure to check passports regularly. Presently, only a few countries, with the United States, Britain, and the United Arab Emirates rounding out top users, actively use it.
Noble says that four out of every 10 international passengers are not checked out using Interpol’s database.
This means that last year , travelers boarded planes without being screened more than one billion times. This doesn’t take into account all of the missing or stolen travel docs that are not even listed on the SLTD database.
Stolen passports are the preferred base for forging, as a lot of the security elements don't have to be reproduced this way. According to some research mentioned on an Australian documentary, one in seven face matches at passport control (done by humans) makes an incorrect identification.
Also the BBC documented how a Syrian refugee managed to fly to London with a forged passport, on his second attempt.