Also points out a security hole; normally credit card companies are a lot less concerned about verifying identity when someone wants to make a payment on an account. Here's an example of why they should.
I remember seeing a news story about a gas company who had thought a customer damaged their gas meter. They replaced it, then deducted the $1000+ cost of replacement from the customers bank account. Since the customer authorized the ACH access, they were out of luck in getting the money back right away. If they hadn't linked their bank account, they would have gotten a bill and could have figure out an arrangement before handing over any cash!
In fact, some banks will not even give you an effective means of removing such authorization. You may literally need a new bank account to keep your account from being emptied in the future.
You give the bank's routing number and your account number to the utility or whomever. That's all they need. That information, by the way, is present in clear text on every paper check you write. The bank doesn't pre-authorize anything, nor can they block anything short of closing your account and giving you a new account number. Your protection is that presenting a fradulent check (electronic or physical) is a crime.
You can reverse ACH transactions by going to your bank and filling about a form and making a declaration under penalty of perjury. It goes back to the merchant as an R10, and the merchant usually deals with it in some other form, though if they've got a good relationship with their bank, they can dishonor the return.