My edtech startup was contacted by an English-language school in a country where we have never advertised and have zero presence. They had a few questions but w

My edtech startup was contacted by an English-language school in a country where we have never advertised and have zero presence. They had a few questions but within 2 hours, they were ready to make a several-hundred dollar purchase. I was a bit suspicious because the sale was so easy (selling to schools is normally a slog, even inbound), and because they immediately asked for our ACH information. I contacted my bank to ask if I give them my ACH info, is there a chance they can do anything bad to me? My bank offered that I could give just the last 4 of my account number, which could be matched to my account based on the business name that would also be provided. This seemed like a good solution, but after trying several times we gave up. They paid via PayPal instead, and we've never had an issue with them. But the experience made me think about how ACH works, and the risks involved!