I don't know enough about this, but would it be possible for the scammers to hijack the SIM swapping?

That is, the scammer manages to get ahold of the SIM card / phone number of the CFO, and be on the receiving end if/when a worker calls the CFO up.

Weakest link would probably be to compromise some telecom worker, so that this can be orchestrated.