> But how exactly does an ACH transfer work?

If you want this from a developer perspective, the subject is discussed in great detail in the following blog post series.

How ACH works: A developer perspective - Part 1 => http://engineering.gusto.com/how-ach-works-a-developer-persp...

How ACH works: A developer perspective - Part 2 => http://engineering.gusto.com/how-ach-works-a-developer-persp...

How ACH works: A developer perspective - Part 3 => http://engineering.gusto.com/how-ach-works-a-developer-persp...

How ACH works: A developer perspective - Part 4 => http://engineering.gusto.com/how-ach-works-a-developer-persp...

and

HN Meta Discussion : https://news.ycombinator.com/item?id=7636066

I'm not a cybercrime expert, but AFAIK once the fraudulent ACH goes through it's a matter of cashing out the money (to literal cash or resalable goods) before the ACH is inevitably reverted. This leaves the recipient account with a negative balance so it can basically only be used once.

That's pretty much it exactly. You use two stolen accounts. One with a large balance, one without. ACH from one to the other with a fraudulent. Hire someone to go into the bank in person and withdraw cash. You're done.

The account to which your money is fraudulently transferred might not even belong to the criminals. They probably have access to multiple compromised accounts and can shuffle money between them to throw off investigators.