What information is needed for someone to withdraw money from someone else's (US) bank account?

Question

I have a US bank account and a paypal account. I wanted to withdraw money from my bank account to my paypal account. The first step was to link the account. I did that by giving paypal my account number and routing number. Then paypal made 2 transfers of a few cents. I told paypal what the amounts were, and they confirmed that my account was now linked. I then requested that paypal withdraw X amount of money to my paypal account, and after 5 days, they did.

I was really surprised that my bank let that go through without me having to confirm with my bank that I am okay with paypal withdrawing money. In fact, the only information that paypal needed was my account number and routing number, both of which are public (-ish) information. Confirming the 2 small transfers was just a step to make paypal believe that I owned the account, but my bank never performed a check to see that it is indeed my intention to transfer $X to paypal.

This leads me to my question, if someone has my account number and routing number, can they also withdraw money? Furthermore, is my bank account now under paypal's "control"? Even if I choose to unlink my account, paypal still knows my account number and routing number. Do they now have the ability to withdraw whatever they want for perpetuity?

Obviously I can sue paypal if they wrongfully withdrew money from my account, but it seems odd that my bank even lets it go through in the first place without my confirmation (I only told paypal that I wanted to transfer $X, not my bank). After all, supposedly, I can't just ask your bank to transfer me $X to my account, and have you sue me if that was done without your permission.

Answer 1

From a security standpoint, your primary protections are that unauthorized withdrawals would be a civil or a criminal matter and that your bank has a fraud department. Companies don't want to get sued and people don't want to go to jail. Banks don't want to have unhappy customers calling up that their account was cleaned out.

If you give me your routing number and account number, I can withdraw whatever amounts I want from your bank account. At least until the police show up at my door with a lovely pair of silver bracelets for me. Financial service companies are going to have guardrails in place to detect and prevent fraudulent/ mistaken transfers so the most obvious/ straightforward paths to actually steal money are going to be cut off. But criminals will generally be able to get around those controls eventually if they want to.

In the olden days when you paid for virtually everything with paper checks that had your account number and routing number printed on them, this was a much larger potential vulnerability. Your handyman/ dog walker/ grocery store cashier could have read off the numbers on the bottom of your check and decided to rip you off. In the vast majority of instances they didn't. Today, it is much more rare that you would give your account number and routing number out, generally only to companies that you trust.

Could PayPal in 2023 go rogue, save your information even when you tell them to delete it, and then steal a meaningless-to-them amount of money from you? Sure. But that's way less likely than your dog walker in 1983 finding themselves in a financial pickle and using the check you wrote them to steal a meaningful-to-them amount of money from you. And that largely didn't happen.

Answer 2

The PayPal user agreement states that:

"Before linking a bank account, you should review and understand the consumer protection rights and remedies available for different payment sources under the Electronic Fund Transfer Act (EFTA) and Fair Credit Billing Act (FCBA)."

It is also written there that:

"When you use your bank account as a payment method, you are allowing PayPal to initiate a transfer from your bank account to the recipient. For these transactions, PayPal will make electronic transfers from your bank account in the amount you specify."

It was your choice to do so. Although Paypal is not a bank, the company still needs to comply with the same government regulations as other financial institutions (source).

That's why PayPal also writes:

"If we're unable to confirm your identity, you’ll only be able to send money and make PayPal purchases using your bank or debit/credit card, not your PayPal balance."

If you don't trust an institution, you shouldn't agree to the terms and link an account.

Answer 3

Essentially this is the same as an electronic "check". The bank decides whether to accept the unsigned transaction, knowing that if you challenge it they are on the hook for the money and have to recover it from whoever submitted the debit, or more accurately from that party's bank who then recovers it from the account, possibly charging a bounced check fee or equivalent.

Your bank will ignore suspicious transactions or check them with you before paying.

So there's limited risk, though it may be an unmitigated nuisance and there may be some bank fees before it gets straightened out. And it does mean you need to be especially careful about reading your statements to be sure everything is legitimate.

The simplest way to get additional protection is to open a separate account for online access use, and give authorization only for accessing that one. Keep just enough money in it to cover your expected spending, plus enough to avoid the bank's low-balance fee if any. Then, should the worst occur, only this small account is tied up until it gets straightened out. Given the ability to easily transfer funds between accounts, this doesn't add a lot of hassle and it does address the biggest concern.