The good news is that once the Airman contacted the bank manager, they refunded him the stolen funds. However, the Airman wasted a lot of time trying to track down who made the ACH withdrawals. As you would suspect the criminals were able to make the transactions look like they were from a legitimate business. When the Airman finally tracked down that business, he found out that he was not alone. The business had received about 100 calls from other victims.
So the best way to protect yourself is to check your accounts at least once a month. Avoiding online banking won't help since brick-and-mortar bank accounts are no different than online accounts in that they can have the same ACH transfers applied to them.
Regulations require banks to reimburse you for fradulent transactions if you report them in time. So the banks are the ones that have the most to lose, and perhaps that's why many have set up blocks against ACH withdrawals initiated from the outside. Banks that I know of which do this include ING Direct, E-LOAN and recently Emigrant Direct.
A few years ago I had a mysterious two-cent deposit to my credit union money market account. It was labeled as if my insurance company, Humana, had made the deposit. The credit union couldn't provide any more info, and my attempts to track down the source at Humana proved to be a waste of time. Luckily, there were never any unauthorize ACH withdrawals. I ended up closing this account a few months later.
For those not familiar with ACH it stands for Automated Clearing House and is used to make electronic deposits and withdrawals from bank accounts. Direct Deposit is one example of an ACH deposit. ACH withdrawals are often done to pay for bills. Many online banks allow customers to initiate ACH transfers to and from their accounts at other banks. For more info on ACH, please see this Wikipedia ACH reference.