This sounds like a very weak excuse. Why can't the bank show the account owner the incoming pulls, and let the owner authorize them? (And then send the authorized ones out as proper push transfers in the next ACH batch.)