Every online payment provider I've examined requires the user to link their bank account to their online account:
Especially in the US, this isn't the most secure setup. As the mentioned in the link, this requires:
- trusting the service provider (directly)
- trusting the service provider's security
- trusting the service provider to insure your money
This trust is required because most US banks do not provide sufficient security for ACH drafts. Standard overdraft protection suffers from the follow negative consequences:
- withdraw fund from a backup (usually savings) account
- apply an overdraft fee
- put the user into credit (debt) if insufficient funds available (within a draft limit, otherwise the draft is simply declined)
In comparison, some account types provide stricter debit protections that flat-out decline any draft greater than the account balance.
So why don't service provider provide their own account and direct users to deposit money directly into this account? I imagine this could be implemented as so:
- create a new private service account per user
- create a public deposit-only account with directions to route the money to account X
I don't know the details so I might just be throwing out harebrained ideas. That shouldn't be an indication that no implementation can exist, because there definitely is a problem. I just don't know if there is a good solution.