I'm not sure that this is quite true but I agree that ACH security is quite poor. As an example, I believe that if there is an authorization for ACH transfers on your account (and Citi does have this) then it's bi-directional. There is no way to say "I permit transfers into my account but no transfers out". Which means that if your employer does direct-deposit (via ACH, as is standard) then they can drain your account. WTF ?!?
3/7/15 at 8:39am