It sounds like there&#x27;s a real market for a simple 2FA system for approving large&#x2F;urgent transactions like this. Something like Google Auth, but with a 30 minute window as opposed to seconds, to keep email viable.<p>Alternatively, the window could be made smaller if the accountant&#x27;s 2FA client kept a short history of valid codes and timestamps.<p>Then again, without a systematic lockout (i.e. putting this restriction into the bank account itself) then the 2FA system could probably be socially engineered away just like any other safeguard.