It's a problem with ACH in general. However, debits from consumer accounts (or, more accurately, those initiated with a "PPD" code) can be refuted for something like two years.

By submitting a file straight to the networks, I could also debit a nonexistent account for $20m and have it show up in my account the next morning. Wouldn't hang around for long though.