The CEO username and password work for me. I've checked the obvious stuff and they have that covered, so it won't be an easy $10,000. But I'm sure no system is 100% infallible :)
Maybe if they texted him a code he had to type in, it would be more secure, but then it would be simple enough to brute force all of the codes, or find the seed and generation mechanism.