I am new to the US banking system and it makes me wonder how easily third parties like xoom.com can withdraw money from your checking account with only the account number and routing number. I understand that somewhere in xoom.com toc and signup process I give permission for xoom.com to debit my account, but from the bank's end they do not do any validation. (In India, for auto debits most third parties would need you to submit a cancelled check to make sure the applicant is the account holder)

Can any other third party get hold of my account number and routing number alone and do transactions with that? If so, how easy is it to get it invalidated from the bank's side and get my money credited back to my account?