I'm not sure ACH is so much less secure than debit. You hand your card out to far more people than you ever send a check to and it has the info they need to use it online unless avs restrictions are enforced by the merchant, which is less secure than a merchant enforcing ACH micro-deposits imho. With both of these authentication methods it is up to the merchant to enforce and they are liable in the end for the most part when they don't. American express doesn't feel the need to enforce micro-deposits because they've already lent you the money so if a payment fails they're not at more risk than they were before the payment was made. In the end, it's easy to obtain the information for both and both have systems for reversing.