You can't just take money with the numbers.

You have to be a bank or otherwise registered with the clearing house.

So you can ask your bank to pull money from my account, and if I object my bank will claw back the money from your bank and they will know who you are.

And if it wasn't all a misunderstanding or a typo, then they know where to find you.

You can just take money with the numbers. A business can just ask for ACH account info for payments. That means a customer could use someone else's "numbers" to fraudulently buy thigs. And maybe that other person wouldn't be liable for the fraudulent transaction, but the customer would still have the stuff they bought without leaving an ID behind.

What businesses allow you to pay via ACH?

Off the top of my head, the only ones I can think of are utilities, other banks (so you can make loan payments), and consumer payment processors like PayPal. In the first two, they'll have your ID. In the latter, they do the "make two deposits" thing to verify you own (or at least have access to) the account.

I can't go to Wal-mart and pay via ACH. Do they even take personal checks anymore?

> What businesses allow you to pay via ACH?

Pretty much anyone with a Stripe account can accept payments via ACH.

https://stripe.com/docs/payments/ach-debit

I worked at an ISP and we definitely appreciated it when our customers paid via ACH instead of credit card. (Less fees.) We were tiny, too; you don't have to be a giant company to get this going.

Stripe is still "your bank".

Of course they still take personal checks. How else would elderly granny that does not trust "plastic" pay? Some would do it with cash, but many have paid with checks their whole lives, and will not stop until they drop dead.

And it certainly used to be common for e-commerce sites to accept "electronic checks" by having you type in the routing and account numbers, with no additional verification. These days, there usually is additional verification.

It is still commonly accepted with no verification for payment for things like utility bills. This appears to be on the assumption that if there is check fraud they probably know the guilty party, because who else would be trying to pay your power bill?

Happens plenty in B2B but, again, reputational risk is involved

This business would run the risk of being cut off from the financial system.

Okay, but the business has no way of stopping this attack, so it is fruitless.

You could hack someone's business bank account and ACH debit other people, yes.

But then you have to get the money out of that account, and into cash in your hands without leaving a trail that leads to you. It's possible, but complicated. And if you could do it, there was probably already significant money in the account you hacked into in the first place. No need to pad it with ACH debits that might set off alarm bells.

The answer is that people DO steal via ACH, just like people rob houses. They are caught and prosecuted. What makes you think no one ever steals via ACH?

I actually know someone who was a victim of this, they had written some checks and the recipient had used them to make unauthorized withdrawals. I believe everything was reversed after the police got involved.

The question I think is more “why does someone have to give me their account details and so allow me to remove an arbitrary amount rather than me providing my account details knowing that all you can do is give me money?”