Due to the nature of the CSRF attacks, the identification of the intent of a specific URL (for example, a salary raise described in the above example) is difficult.
The identification of a malicious request is not always possible between the user and the server.