It sounds like there's a real market for a simple 2FA system for approving large/urgent transactions like this. Something like Google Auth, but with a 30 minute

It sounds like there's a real market for a simple 2FA system for approving large/urgent transactions like this. Something like Google Auth, but with a 30 minute window as opposed to seconds, to keep email viable. Alternatively, the window could be made smaller if the accountant's 2FA client kept a short history of valid codes and timestamps. Then again, without a systematic lockout (i.e. putting this restriction into the bank account itself) then the 2FA system could probably be socially engineered away just like any other safeguard.