The "anyone can pull money out of your account" piece is true but it also isn't. Yes, if a financial institution allows you to originate a debit from another a

The "anyone can pull money out of your account" piece is true but it also isn't. Yes, if a financial institution allows you to originate a debit from another account without verification, you could take money from anyone's account. The max liability you should have given prompt reporting of fraud (less than 60 days) is $50, and if your institution doesn't give it all back then find a new one. ACH is also technically reversible, whereas wires/other instant transfers are not. FIs also do fraud checks on ACH, I believe it may be a regulatory requirement now (sometime in the past few years?) to have some form of fraud check before sending originations to the FED. Typically this is verification of the other party being a known entity/account, which would ideally burn fraudsters very quickly. Most transaction facilitators don't play around with any of this though, and have some "account linking" step before they are willing to originate transactions. Micro-deposits that you would need to verify on the other account.