According to my bank ACH's can be revoked without the account holder's permission. Similarly, once the ACH link is set, funds can be withdrawn without the account holder's knowledge. I'm glossing over the terms and conditions account holders sign that enable this, because the essential point is that opting into an ACH funds transfer relationship can have consequences. We avoid ACH in our business for transactions of any real size.