Back when I was in college, many graduate students had paid positions at the university and used direct deposit. One student (a friend of mine) was a victim of a "computer error" -- someone entered an extra "00" into the computer. Even though he was not overpaid, the computer thought he was, so it initiated a "direct withdrawal" in order to recall the funds. The student noticed this as soon as his bank told him that his account was empty. It took a day for him to talk to the right people at the school and they acknowledged the error. However, it took a semester for the school to put the money back.
This problem is not isolated to universities. Every Fortune-500 company that I have ever worked for has had their share of announcements. "Dear employees; due to an accounting error, every employee was paid for two weeks instead of one. We have corrected this by withdrawing the overpayment from your account."
Most people do not realize that "direct deposit" means "direct withdrawal". And today, many employers have mandated direct deposit, so it is no longer a choice. This problem is exacerbated by companies like PayPal, which are extremely difficult to contact when problems arise.
Unfortunately, there are few good solutions. Playing games like immediately moving all deposits into another account (even at another bank) only limits the problem. For example, if a mistake is found (or an errant deposit recall is issued) within a few days of the deposit, then the moneys can still be recalled even if it was transfered between banks. However, by moving the moneys, you ensure that they cannot withdraw more than they deposited (or more than exists in the initial account). And while they might drain the deposit account, they cannot drain the transfer's destination account. (Make sure your bank does not link the accounts and do not enable any overdraft protection on the deposit account.)
The best solution, of course, is to take the money out in cash, and then redeposit it into a different account. The withdrawal can usually be done after a three-day waiting period. Using this approach, the payer can always try to recall payments, but there are no funds to recover. Then again, withdrawing a $10,000 deposit in cash -- or even a bi-weekly $1,000 deposit -- can raise suspicion at the bank and will likely lead to a
SAR (Suspicious Activity Report).
The banking industry has known about this problem for decades. However, it hasn't become a big enough problem for them to address. Ideally, banks should create deposit-only services. (A recall is still available, but no direct withdrawal.) Unfortunately, I don't know of any banks that offer "direct deposit only" services.
I recon that banking practices differ between countries, and maybe US banks have tied deposit and withdrawal agreements into a single bundle, but then it should be in the interest of both banks and customers to change this practice, ASAP.
Because as you say: if my employer (or anyone) has an unlimited option to transfer money out of my account, then I as a customer will transfer money out of such account as soon as it gets there. Presumably I would transfer it to another bank. This means customer deposits leaving the bank providing the direct deposit service.
I saw this happen regularly with ATM withdrawals as well as with automatic payments for bills. What happens is that the bank allows the money to be withdrawn, which will overdraft your account, and then charge you a fee for doing so. The fee was around $30 per transaction.
And then your left to argue with the withdrawer or your bank to get your money back.