I am generally a fan of more layers of security just to be safe. So, I may also set up a separate account just for wire transfers because nowadays it's not difficult to manage things like that.
I gotta ask though, you bring up that the scammer now has your routing number and account number. But that is also printed on every check you've ever written as well. I feel like they would be able to deposit money into my account with that information pretty easily, but it's hard for me to imagine that the banks would willingly just send anyone money from an account just based on the two numbers that are on every check ever written. Is there something I am missing in that equation?
I haven't used a check since the debit/credit card came into use. Except for gas, and vehicle maintenance, I use cash for most purchases under $100.00 and credit card for all other purchases. For purchases requiring a check I use my credit union's cashier check or postal money order.
With the account information: a hacker: can use an algorithm / program to electronically remove/reroute transfer funds. A scammer, can imitate you to gain access and transfer funds, or counterfeiter can make multiple duplicates of your check to transfer funds.
Think of it as:
A hacker inserts an algorithm or hidden program to an email or text message. The receiver then opens that seeming innocent email or text message. The algorithm or program is activated. Personal information can then be gathered from computer, phone files. Mm
A scammer calls, texts a person then gains general information. They can then call the bank and using short simple edited words to respond to questions to gain loans, transfer money out of a person's accounts, etc.
A counterfeiter has a check then they can make photocopies of that check adding/changing the amount the money draining the account holders funds.
In the end the criminal makes off with the funds and the account holder is left trying to prove they didn't authorize these withdrawals, payments, etc.
That's why there are so many advertisements, commercials, etc offering ID protection services. Although some if not most of these companies' commercials, ads are relying on "scare tactics" to sell their products. They do somewhat, very weakly, legitimately alert the public to beware on giving out personal information to unknown callers, solicitation calls, etc., opening unknown, harmless looking, etc, emails and text messages.
Sharing/posting personal information on social media: family members names, pets names, favor places, etc. Then all it takes is a Google search. Then a scammer, hacker can impersonate their victims.