- Is there any way to prevent this?
Yes and no. You can't prevent email from being spoofed. But you can use electronically signed emails, and you can advise the IT staff to start using DKIM or similar, to prevent such emails from being accepted. After that:
- a non-DKIM or non-signed email will be considered a forgery and rejected.
- users will need to send emails through the organization's servers and/or sign them digitally with their private key.
- users will need to only check the company email through the company server (no simply forwarding to convenient GMail accounts readable from the cell phone. You can still do that, of course; it just gets more complicated).
- Is there any way to report this given that it comes from the great internets?
Not really. You can try checking the headers and report them to the appropriate abuse office (i.e. that of the originating domain). Most such emails come from either zombied individual systems (maybe operating in groups - so-called bot nets) and/or domains and organizations that have been found to be either unresponsive or straight away friendly to forgers and spammers. There are actually lists of "promising pasture" networks circulating that allow abusers to find new victims.
- What security precautions (apart from please check emails carefully before replying) can I advise the finance and other teams?
Other people (the IT team) should implement what precautions can be taken, and the necessary infrastructure (for example, if lots of employees need to send emails while on the go, they might need to be equipped with VPN software so that they can securely use the organizational infrastructure even while on insecure grounds such as an Internet café somewhere). The other people should need do nothing except, as you suggested, carefully double check; and of course use properly whatever infrastructure they've been equipped with.
So, for example, if you do have a secure mail server, you need to go through the bother of actually firing up the VPN connection, authenticating, and sending the email, rather than just shooting an email from the hip from some unsecured hotel room WiFi.
That's particularly important for "weighty" individuals which, in my experience, often are tempted to consider themselves above the law, and will insist on having their emails read and immediately acted upon whatever the source, as they "haven't the time" of jumping through the various IT hoops (they are right up to a point: the security infrastructure must be as easy to use as possible, or it will be seen as a burden, will be routinely worked around, and thereby made useless).
One thing to carefully consider is how the various users connect now to the organizational infrastructure. In-house employees are obviously the easiest. But some OSes and cell phones, for example, cannot use certain security measures. So you either replace those devices, make do without those measures, or resign to some users being cut off from the network in certain circumstances.
In a pinch, you might need to set up some emergency procedure should the CEO ever find himself really stranded in Elbonia with no luggage, no documents, and need money to be sent over to catch a flight back home.