This is a hard attack to defend against - because the person sending the money can also two-factor authentication them. With that said - internally, there are

This is a hard attack to defend against - because the person sending the money can also two-factor authentication them. With that said - internally, there are usually lots, and lots and lots of controls over who/how one can send money, and it's pretty darn rare for someone to be able to "spoof" a request like this without throwing a lot of red flags.