Most banks do have something in place for whitelisting transfers, but adding new recipients is often protected by the same regime that the Zeus bot controllers have already broken.