Fraud looks normal now.
It doesn't look like hacking. It looks like a normal invoice in a normal email thread, or an urgent call from someone who sounds like your partner.
Tools can't see that. A rule can: any change to payment details gets confirmed by phone, on a number you already had.