I have a US bank account and a paypal account. I wanted to withdraw money from my bank account to my paypal account. The first step was to link the account. I did that by giving paypal my account number and routing number. Then paypal made 2 transfers of a few cents. I told paypal what the amounts were, and they confirmed that my account was now linked. I then requested that paypal withdraw X amount of money to my paypal account, and after 5 days, they did.
I was really surprised that my bank let that go through without me having to confirm with my bank that I am okay with paypal withdrawing money. In fact, the only information that paypal needed was my account number and routing number, both of which are public (-ish) information. Confirming the 2 small transfers was just a step to make paypal believe that I owned the account, but my bank never performed a check to see that it is indeed my intention to transfer $X to paypal.
This leads me to my question, if someone has my account number and routing number, can they also withdraw money? Furthermore, is my bank account now under paypal's "control"? Even if I choose to unlink my account, paypal still knows my account number and routing number. Do they now have the ability to withdraw whatever they want for perpetuity?
Obviously I can sue paypal if they wrongfully withdrew money from my account, but it seems odd that my bank even lets it go through in the first place without my confirmation (I only told paypal that I wanted to transfer $X, not my bank). After all, supposedly, I can't just ask your bank to transfer me $X to my account, and have you sue me if that was done without your permission.