...electronic bill pay is it appears as if anyone could stuff my bank account number into a payment and it would go thru. Probably get bounced, but I wonder what protections are in place
This is the crazy part, this is true!
If I know your bank account number -- which is written on every check -- and your routing number -- which is also written on every check (also is public if I know your bank) -- then I can make ACH payments! All day long! For any amount! They'll probably settle! (if your account has the funds)
The issue is when you check out your account sometime in the future, you say: "Hey, this isn't me!" and your bank says: "no problem" and undoes the transaction. They literally take money out of the account you transferred it to. Done! This is a ridiculous pain for the banks, and a lot of times they charge back to another bank, so it's really on the receiving bank to make sure someone isn't stealing and withdrawing the funds. Obviously in the case of a utility, they have an account with the receiving bank, it's probably never empty, so when I use your money to pay my electric bill, my electric company's bank gives your bank the money back and then the electric company says to me: "WTF? Give me the money" and we're back at square one.
Protections in place are only partly algorithmic. If I do an ACH transfer from your account (unauthorized) to my shady shell company account, I'm probably not doing one transfer. I'll probably do it to a lot of people, which looks great - I get to steal more money! But it's also more likely someone is going to spot that transfer. At that moment, the bank fraud department kicks into high gear. Now they can freeze the receiving account, and they might decide to roll back all the ACHs that they can't verify to that account. If the bank sees a new account open, and all of a sudden a bunch of ACH transfers into the account - what do you think they do? They definitely don't just figure it's fine. They proactively start looking and trying to figure out who the receiver is, before they ever let the money go.