It is still really bad - (again if it was the case) monitoring very simple things like "# of changed payment" instructions could detect this sort of fraud quick

It is still really bad - (again if it was the case) monitoring very simple things like "# of changed payment" instructions could detect this sort of fraud quickly, or at worst speedbumping the time to change payment instructions. Pre self service on the internet call centers / mail in processors would have noticed if a large % of customers changed their payment details over a few days.