As I understand it, ACH transactions are protected by the ability to revoke them when you can, for example, show the signature was forged. Credit cards work similarly if your card is hacked. This may cost the bank/credit card money, but it seems to work well enough for them.