Transport rule does not check forwarded email's "subject or body"?

Hi. I think I may be missing something here.
Let's say:
1. I create a transport rule that checks if an email's "subject or body" contains the word PASSCODE

2. If I send in an email that contains the word PASSCODE, it gets caught.
3. But... if I forward an email that contains the same word, it does not get detected.

It appears that the content of a forwarded email is not considered "body". Is this correct?
And if so, is there a way to set up a rule that will will detect this?

Thanks