I once worked for a large telco, and although there were some basic security and verification processes in place internally, they were not rigorously enforced. An imposter or social engineer with malicious intent and the level of company-specific inside knowledge this scammmer had about their chosen targets for impersonation could wreck havok at my old employer, or I suspect many other large companies.