I used to do Accounts Payable for a large tech company. Any invoice >$5,000 had to be matched to a PO. POs had to be approved by an appropriate level. Payment information was maintained by a separate team and POs were linked to that payee. Nearly all payments were done via ACH; we actively discouraged wire transfers wherever possible by charging ridiculous fees. The payment process itself was also audited daily by the payments team. We also had an entire org of finance people responsible for controllership. This fraud would have been hard, though not impossible to pull off in this system.
In a former life I worked with a large procure-to-pay ERP system, and we were even stricter.
Vendors had to be pre-approved and their bank details managed, who were explicitly matched to POs, explicitly matched to invoices, and finally... invoices had to be matched to inventory receipts before any sort of payment was triggered. POs had to be approved by someone internally with specific approval levels as well.
Not sure if we were insanely overboard but... no idea how this happened.
I wrote an application that's primary function is reclamation of unclaimed AP credits / duplicate payments. You might be surprised by how much space there is for better controls here in large (Fortune 500) companies.
Same, I did accounts for a government department once.
But it is amazing how bad some private companies accounts are. We ended up effectively advising them on their accounts receivable.
The thing about this particular scam is the size; no-one goes hunting for POs and invoices for $100m. (or everyone assumes someone else has). It's the success of the big lie.
I hope someone writes a book or they make this one into a movie. It would be awesome if the scammers had an account name using a very similar name or a unicode hack. Too bad they didn't have a better getaway plan.
Also look out after any publicized fundraising. The phishing attacks begin with similar things where people impersonated the CEO to the head of finance pretty much a few months after fundraising. They know the small companies don't have the same sized finance & legal teams.
Blockchain doesn't seem like the most appropriate solution here because what you really care about is basically document signing. The ledger can be maintained by a central authority (accounts payable).
If a vendor sent their bank details via a signed message in the block chain then a change of bank details could be arranged by sending a new signed message from the same address with the new details. Obviously it would need to be agreed in advance that this is the method of changing payment details, then the buyer can absolve responsibility to the vendor as it will require the vendor to maintain security of their private key.
