Fraud looks normal now.
It doesn't look like hacking. It looks like a normal invoice in a normal email thread. Same sender, same format, same amount. Only the bank account number changed.
Antivirus doesn't read invoices. A rule does: any change to payment details gets confirmed by phone, on a number you already had.