Hacker News Reader

ACH works on a pull basis rather than a push basis. Instead of telling the bank "send $100 to account XXXXXXXXXX at bank YYYYYYYYY" you tell the bank "give me $100 from account XXXXXXXXXX at bank YYYYYYYYY". That makes it okay for paying a large business that is easy to track down if they take too much, but it makes it unsuitable for paying a normal person because they could just empty out your bank account and then disappear.

View on HN

Just a heads up it actually works both ways. The originating depository financial institution (ODFI) can submit debits (pulls) or credits (pushes) which are then ultimately transmitted to the receiving depository financial institution (RDFI).

Often banks and credit unions will limit ACH origination to debits (pulls) in digital banking applications for risk and business reasons.

You are right that ACH (and most payment schemes in the US) have substantial deficiencies in terms of security, but that is counteracted with a strong justice system and consumer laws. You shouldn't really fear about someone emptying your bank account (unless you are a business) because Regulation E mandates that banks and credit unions make you whole for any fraudulent transaction reported within 60 days of the statement that includes the relevant transaction(s).

Reply on news.ycombinator.com