Maybe there should be a mechanism that prevents highly unusual market transactions until confirmed (or rejected) after a minimum amount of time has passed (like 24 hours), such as renting or buying a card for way more than the current market price (this seems to be one way attackers quickly move funds out of the victim accounts).