Just for your knowledge, for US ACH transactions;

Banks approve account holders to make ACH transactions for security and liability reasons.

ACH is two ways, to credit funds (send monies) and also the debit (take monies [e.g., automated bill pay]).

So, when you give anyone access to you bank account (furnishing routing and account numbers) you open that bank account of yours to their use.

Now, I have limited any activity to the account I use for ACH (and my Debit Card for that matter) by trying to keep around $1,000.00 in that account to limit any potential fraud or loss ? what I do is use my internet banking and transfer any ACH (or wires) received to another account that is unknown to others ? only I and the bank (and perhaps the government) know any details of this/these account(s). The money is safe in that account.

The above is a form of self insurance ? limiting the loss. My bank will sell you a plan for allow/disallow any ACH user of access to your account but it is $40.00 a month. For $480.00 a year I'll just self insure as I am doing.

Wires must be initiated by the account holder in most cases (as far as I know), with certain exceptions for errors maybe.