It's possible there are no real protections to ensure a clawback is "legit," other than shifting the burden of verification from the customer to the bank. Now fraudsters need to convince the bank that a payment was invalid, compared to convincing a customer that an address is what they expected.