This question already has an answer here:
Why doesn't every bank account come with a "deposit only" number? I.e. why do I have to give my account number (and thereby give the ability to withdraw money from my account) to someone whenever I want him or her to send me money? It seems like a deposit only number would add a lot of security and confidence, so there's probably a good reason it hasn't been adopted.