[toasterlovin]

Things aren't actually that simple. In terms of preventing fraud by the merchant, it's similar to credit cards in that the merchant needs to have a relationship with a bank in order to process ACH payments. That bank does underwriting on the risk of the merchant and has fraud prevention mechanisms in place.

For someone other than a merchant to transfer money out of your account with just your bank details, they would have to either try to pass a fake check or set up your bank account as an external account that they can transfer money out of to one of their own financial accounts. But external accounts are typically verified with test deposits before they can be transferred to/from.