Re: We have a passphrase because of the "Hi mum" scam
"Bit harder to do in a corporate environment."
It shouldn't be. Anybody with the authority and access to large amounts of company funds should be taking seminars on the latest scams all of the time. Somebody could even print them out and leave hardcopy in the loo. The best defense is to have a rigorous written process for the movement of funds. Anything that show up that's off-nominal should be suspect. Even with something such as one company buying out another and there being large transfers, all of the methodology should be spelled out in advance and any changes at the last minute such as a change in bank accounts to receive the funds should trigger a set of protocols. If that causes a delay, so be it.
Large companies set up their vendors so those vendors are fully documented in the A/P system. There will be a whole checklist before checks are sent and there should be a rigorous process of re-verification if the vendor is changing banks, addresses or official company name. I'd suggest that at some point in prior to any changes, the vendor much send a memo detailing those changes and the date they will or are estimated to take effect. If there is no advance notice, the vendor payments could be put on hold. I could see a case where the vendor's bank goes into administration and they have to open another account someplace else, but that change shouldn't be handled via email, text or social media. Depending on the amounts of money involved, it could be prudent for a personal visit.
The scams are nearly always a last minute emergency situation. Very few grifters are willing to play the long con.