How to make it state of the art?
When is depends on the people involved? Those are the ones usually at fault.
I've seen stores repeatedly, with big messages, meetings and demonstrations in front of the entire lot of staff state "if someone phones saying they are from the bank, do not put digits into the credit card machines!!!"
Next week we got another reminder of "those who are still making the same mistakes". Let's just say the other companies I've worked for never got to the first hurdle with the scammers. Why? Because the staff knew already, before they were recruited, not to be suckers.