I believe that's also a US-specific problem. In Australia, a regular person with knowledge of my bank code (BSB) and my account ID isn't able to withdraw money

I believe that's also a US-specific problem. In Australia, a regular person with knowledge of my bank code (BSB) and my account ID isn't able to withdraw money from my account, but they can send me money. It's very low risk. For the last few years I've been able to associate a phone number or email address to my bank using PayID[1] which eliminates even that. The BSB + Account ID can be used to set up direct debits, it's intended for ongoing/regular payments like utilities/rent/etc. Because it requires a fair bit of paperwork/infrastructure to get registered in that system, I don't think anyone would be able to get away with scamming using it for long. [1] https://payid.com.au/ https://payid.com.au/