I've worked for companies in the past where no money would ever be paid out to anyone but government (tax bills etc.) without the party sending them the invoice having a valid purchase order number that referred to a pre-agreed supplier record that specified tha company name and address and the bank account to send it to.

It was annoying at times, but it also meant their accounts department could match every single expense to a specific contract or pre-agreed authorisation, complete with who (on their end) had made the request and who had signed off the request.

Even if you don't do that for everything, even just doing that for everything above a certain amount would make such fraud a lot harder.

Try to call international company with thousands of workers and get somebody who knows anything on phone. Also, most workers simply don't care for a tiny chance of scam, it's not their money after all.

A phone check can solve a lot when you've got a single point of contact at a company and they know all its subdivisions and are on first name terms with the accounts receivables department(s). That's not likely to be the case for a large multinational with multiple divisions selling multiple products to different divisions of the client, especially assuming the scammers have socially engineered their way to having enough information on existing contracts and invoices to be able to plausibly adapt them for their own purposes.

Quite likely people on the other side (employees of the victim companies) collaborated with him and got their share...