Account-number only pulls (eg ACH Debits) are insane. Where I'm from people, charities etc routinely publish their bank account numbers if they expect to receive money from strangers.