Job Termination due to Phishing- Urgent Advice Needed!!

My friend is on an F-1 visa (CPT) and was working full-time. Just today, she received a phishing email that appeared to come from a legitimate internal company email (which was later found to be hacked). Believing it was valid, she processed a payment of $300k and the payment was also approved by her manager. Later, it was discovered that the money had been sent to a fraudulent account. The company immediately terminated her, stating it was her responsibility to verify the account details. However, this type of payment processing was a regular part of her job, where she typically receives internal email requests and manager approvals.

We are trying to understand:

• What rights does she have in this situation?
• Can the company hold her personally liable for the amount?
• What should she do next, especially to maintain her F-1/CPT status?

She is getting with her DSO and lawyer, but any advice, similar experiences, or guidance from the similar situation would really help. Thank you.