That’s the default for at least Germany and SWIFT, too. You can ask your bank to disable this, but that means losing the pull functionality completely; I think some banks have an interface to whitelist individually, but the majority doesn’t.
It can become a problem especially when you list your account number publicly somewhere for payments or donations: somebody will eventually use that account number to pay for random stuff. You’re contractually obliged to check your bank statements and ask for a (free) chargeback within a certain period of time (some weeks?).
At our projects, we solve this by having a separate “public“ bank account for incoming donations that blocks pulls, and a much less public one for pulls.
Apart from this use case, abuse seems to be rare enough that banks typically don’t expose the functionality to disable but only do it manually when asked specifically. I doubt most people even know they could.
13 months!
After that, it's a much more formal process where your bank has to get in contact with the other bank and it can take weeks.
Yes, if a financial institution allows you to originate a debit from another account without verification, you could take money from anyone's account. The max liability you should have given prompt reporting of fraud (less than 60 days) is $50, and if your institution doesn't give it all back then find a new one.
ACH is also technically reversible, whereas wires/other instant transfers are not.
FIs also do fraud checks on ACH, I believe it may be a regulatory requirement now (sometime in the past few years?) to have some form of fraud check before sending originations to the FED. Typically this is verification of the other party being a known entity/account, which would ideally burn fraudsters very quickly.
Most transaction facilitators don't play around with any of this though, and have some "account linking" step before they are willing to originate transactions. Micro-deposits that you would need to verify on the other account.
So in the EU, anyone can indeed pull money with your account number (and with RTP that may change someday). But we can also revoke any such direct debit within a certain period of time.
I had to do it once, over my banking app, money was back the moment after I clicked.
Whoa, I don't blame people for not wanting to provide ACH numbers in that case. Is there any groundswell to provide a system where this doesn't happen?
However, I'm not sure if it uses different account numbers from ACH. It could be that sharing account numbers could be secure with FedNow and dangerous for ACH.
This is because in the US, anyone can pull money out of your account with only the ACH numbers; which is an insane design[1]. In most other countries, the worst you can do is deposit money. The equivalent of ACH pulls requires significantly more paperwork and proof of consent by account owner.
1. Much like SSNs, which can be debilitating if not kept secret. US payments run in "true names" magic, and simultaneously expect you to register with your one true name at random places with questionable security practices, and it's your fault if there's a breach.