Addresses are one of the key pieces of security information for an account. They're used for authentication, determine where statements go, and changing an address on an account provide enough information to allow an attacker to drain an account if they get the monthly statement. Yet, they do need to be updated from time to time.
What can one do to protect against fraudulent attempts?
Certainly, one can ask an extra question that's not normally asked in the regular online banking process. That will provide some measure of protection.
I think the best defense, though, is to ensure that a change of address triggers mailing a notification to the old address. Then delay any mail to the new address for a week. If the change was fraudulent, this gives the user a reasonable opportunity to respond. Automated phone calls to the former phone number of record may also be helpful.
As the main risk is that a fraudulent user will change the address so to misuse the account, one very effective security control in this case would be requirement for 2 factor authentication - know, have, or am. For example, before completing the address update, you can have the user enter a password / PIN as well as a string of random numbers on an RSA token.
Bank of Americaone of the largest banks in the US is being able to log into the account itself.