In Israel, the same arrangement exists. I was very surprised when I learned that in the US you give to the company your account number and they basically can initiate money pulls any time they like and the bank does not have a list where you say who is approved and who is not. That seems to be kind of backwards and insecure. I know there are probably ample reasons for that but I'd feel much better if it was arranged like that. Paypal and Amazon Payments and other systems like this provide partial solutions but why banks wouldn't do that? Looks like something that belongs there.