(The UK system of account number/sort code does allow you to set up malicious direct debits against other people's accounts e.g. http://hoaxes.org/weblog/permalink/clarksons_account_gets_ha... - BUT the direct debit guarantee system is supposed to make them all reversible, and you can't DD to arbitary accounts, you have to be a verified merchant.)
All you need is a routing number and an account number to initiate a transfer of funds in either direction. PayPal and others use this as verification of account ownership by initiating a small deposit and withdrawal, prompting you for the amount.
(The UK system of account number/sort code does allow you to set up malicious direct debits against other people's accounts e.g. http://hoaxes.org/weblog/permalink/clarksons_account_gets_ha... - BUT the direct debit guarantee system is supposed to make them all reversible, and you can't DD to arbitary accounts, you have to be a verified merchant.)