Yeah all that is needed to do an ACH pull is a name, account number, and routing number. There is no real security.