It ain't easy
$PREVIOUSEMPLOYER got suckered by fake IGBTs. Their supply chain was unbelievably short: Fab-Warehouse-Factory. 3 steps, including themselves, massively complex 'release record' tracking, numbering, back-checking, supplier visits, external audits. But they still got suckered for $INDUSTRIAL_QUANTITY of Euroes. Police never solved it.
'twas reckoned the bad guys had to have people on-payroll in all 3 steps to get away with it.