To understand this, you have to think past step 1 of the evil plan to steal all your money. First, in order to do ACH withdrawals, one must have a bank account that is strongly tied to your identity. So as a criminal, I steal your bank account number and force a fraudulent withdrawal - now that money is sitting (*not really, that's point 2) in my personal bank account, which is easy to trace.
Second item - these transfers take a few days to settle, so I've "stolen" your money, but I can't withdraw or transfer it to my EvilBank offshore account for a couple of days.
And finally, if you don't notice and tell your bank about this, and I can wait past the settlement period and withdraw the money, now I've got federal law enforcement after me for wire fraud, and they know who I am due to #1, so I'm in a world of hurt.
> a bank account that is strongly tied to your identity
Correction: strongly tied to some identity. For online banks, for example, there's not much they can do to check if it's not a stolen identity. You'd need a lot of data - SSN, addresses, driver's license, etc. - but it's not out of the question to obtain such data from dark markets. Of course, withdrawal still be a problem, and this identity package will likely be burned once the first fraud notice will happen, so it may not be worth it to waste it this way.
Yes, I regularly use ACH to send and withdraw funds from my online accounts. That's pretty much how I do all my banking - I almost never set foot in a physical branch unless I need something big like buying a car. Of course, before opening online bank account, they ask me SSN and all kinds of details, but good stolen identity package (e.g. from the same bank that I gave all those kinds of details, or from one of the credit bureaus) would cover that.
That's why you have to freeze your credit, btw. They won't open an account on SSN with frozen credit - you'd have to unfreeze first, and that's usually harder to do for a crook.
Second item - these transfers take a few days to settle, so I've "stolen" your money, but I can't withdraw or transfer it to my EvilBank offshore account for a couple of days.
And finally, if you don't notice and tell your bank about this, and I can wait past the settlement period and withdraw the money, now I've got federal law enforcement after me for wire fraud, and they know who I am due to #1, so I'm in a world of hurt.