The reality is that it's tough to verify somebody's identity in remote work. The office used to be a walled garden, and now people seem to treat chat as a walled garden. We'll probably see more security incidents like this in the future.
- compare the person with an ID on file
- invite the manager or a colleague of the person into the call to confirm
- ask for PII (birthdays, address) that are on file
I assume someone assuming the identity is more reluctant to show themselves on video. Furthermore being asked PII they are likely not as prepared.