> but they can't walk into a bank and withdraw money.
Depends on how you define withdraw. If you define it as filling out a withdrawal slip and giving to a teller, then probably correct. If you however mean in a generic sense taking the money from your account, then no, it’s certainly possible and not very hard, and all you need is account number.