ACH is a legacy system that can be easily abused for sure - what's saving it is the fact that it's not real-time like it's newer counsin RTP. It also helps that

ACH is a legacy system that can be easily abused for sure - what's saving it is the fact that it's not real-time like it's newer counsin RTP. It also helps that withdrawing money via ACH requires an account and payment processor willing to clear ACH for you and shoulder some of the responsibilty. Yes, you can copy the numbers and make a fake checks to cash, but security features on the check helps with validation and most Check Cashing places don't cash big checks - mainly because they take on the liabity if the check bounces. It's also the reason why most bank requires you to have an account with them to cash a check depending on the amount. So in summary, it's relatively "secure" due to validation & delay clearing the check. Scammers know this very well - that's why they resort to overpaying invoices/items with fake checks only to demand refund from the unsuspecting mules - who end up holding-the-bag once they send out the refund, only for the check to bounce. Another similar legacy system that is easily and more abused is checks via mail - it's easier to cash a REAL check with a fake ID compared to a fake check for reasons I mentioned above. Why some companies still insist on paying or being payued via a check is beyond me!! Stolen checks is a bigger issue compared to ACH - in fact it's a federal offence to steal mail, post office even have Postal Police to deal with the issue.