Honestly, I just hate how insecure and legacy everything involving banking in this country is. For example, payroll - there's literally no reason your employer needs to store your account and routing number as another piece of your personal info that they can lose when some hacker finds out their MySQL admin password is "admin" Like, the system should be that you give your employer your banks name, plus a UUID associ…
As a non American, the idea of a bank account number being a kind of secret that is usable to pull money out of the account is the most curious thing to me. I guess something like this can only exist in a high trust environment.
For someone other than a merchant to transfer money out of your account with just your bank details, they would have to either try to pass a fake check or set up your bank account as an external account that they can transfer money out of to one of their own financial accounts. But external accounts are typically verified with test deposits before they can be transferred to/from.