How is it secure to allow withdrawals from my bank by just giving an account number to a financial institution?

You always have two options when paying bills that will come directly from the bank account:

• Have the vendor pull money from the account by giving them the routing number and account number of the bank account.

• Give your bank the information need send either a paper or electronic check to the vendor. That requires you to provide to your bank the vendor name, address, phone number, and your account number.

Pulling the money has risks. They could pull too much. They could be evil and empty your bank account. It also has benefits: you can see on the vendor's website that you have paid the bill. You know that most vendors will consider the bill paid if they have used the bank and account info in the past, and there is a network issue that prevents the bill being paid on the date they try to pull the funds.

Pushing the money has issues also. You have to figure out how long it will take to get the check to the vendor. Electronic ones take a business day, paper ones take longer.

Either way you have to check your bank account to make sure the transfers match what you expect. The bank will usually give you a period of time to dispute a transaction.

The bank has systems in place to look for fraudulent transactions, but you are right they can't block everything. You as the owner of the bank account have to be vigilant about checking the transactions regularly. With most banks you can even setup alerts to get an email or text if large transactions occur, or if the balance gets low.

For me the easiest/safest way is to have the vendor bill my credit card. That allows me to dispute the amount or the transaction. They can't empty my bank account. I only allow a pull directly from my bank if they charge x% if I pick the credit card option, and I trust them 100%.

I believe one part of what you are asking is,

How is that secure? Anyone could enter my bank number and so withdraw my money.

Consider Bank X.

So, as you explain certain companies, let's say ELectric Company E, can taked $50 from your personal bank account,

and the only thing E needs to know is your account number.

However ...

Note that not just anyone, not just any company, can do that process.

Only companies (example, E) that are extremely well-known to and integrated-with the bank(s), can do that.

I believe that is the sense of what you are asking.

(An interesting question is, has any whole-fake-company ever pulled off enough of a "deep fake" to get in such a position? IDK.) {Note that if some whole-fake-company achieved such a scam, the bank(s) would just take back all the money, so it probably is not a scam-route that any scammers would follow?}