> How do we know that this unusual transaction is you doing what you want and not someone else controlling and defrauding you?

That's what they'd like you to believe, but fact of the matter is that you're still not protected. For example, at my last company, the finance department was phished into changing a bank account number and transferred $50k to another account. Bank just shrugged.

Did they get the 50K back?