You cannot secure any system against intentionally criminal behaviour - and it looks like the actual transfer had started an investigation.