It's pretty simple to do a hot/cold account setup at most banks. I've got a checking account which is unlinked to all other accounts and I try to keep it at a $0 balance. The online banking site makes it easy to transfer money into and out of that account from the accounts I keep money in.

It's a little more work to stay on top of transferring out money when it gets deposited and putting it in when I want to spend it, but it gives me a bit more piece of mind when giving out routing/account numbers.

That's an excellent idea. My bank(s) have a so-called Savings Account (separate from the main Checking Account) that yields a microscopic amount of interest, which I never use since I 'save' money elsewhere. That might be a great use case for what you describe.

So if you write someone a personal check they can empty your account?

Yep, and this happened to Donald Knuth: http://www-cs-faculty.stanford.edu/~knuth/news08.html

This is just bananas. I always thought the routing/acct would just authorize deposits. I assumed this, because every time I need this info, I look at my checks. (When people wire money to me).

When you write a check, the signature is the authorization to withdraw funds, and the amount and recipient is specified.

I’m shocked that banks would permit a withdrawal without some kind of “anolog” to this authorization pattern.

It makes all these worries about passwords and online credentials seem quaint. These numbers are all over the place, online and off. Why aren’t halfway clever hackers draining accounts right now?

It’s a huge risk mitigated by the banks being a mostly-trusted network. If someone abused ACH they’d lose access to the network quickly, and your bank can build checks in on their side so if a transaction arrives from a foreign bank they might call you to confirm (when I bought my house the down payment was large enough to trigger a confirmation visit).

Yes but I believe with ACH you have 60-days to dispute the fraudulent debits.

It is like transactions are in P-time and disputes are in NP-time.

Of course. There's no inherent technical countermeasures against someone doing so.

But isn't the same the info you provide to companies like Coinbase (account and routing number) on the bottom of all of your checks? Oh, but if they're a merchant they have different abilities?

Yeah, normal people cannot initiate ACHes but merchants can.

No, all one needs to do is have access to the routing / account number and one can start withdrawing funds, paying bills, etc. There is nothing in place to prevent that and nothing else is needed.

And the police will do nothing about it. Even if the fraudster uses your checking account to pay for their power bill. Good luck getting the police in a big city to head over to the house and investigate.

That might be true in isolated cases with dysfunctional police departments but there are a lot of people in jail for charges like check kiting who’d disagree with you.