Thieves know there's a possibility the transaction can be cancelled, which is why they tend to strike on Friday afternoon. By the time the theft is discovered the destination account has already been drained.