1 article on this topic.
How an attacker substitutes a payment address in transit, why both parties see what they expect, and the confirmation that stops it.