Aside from my SSN, card numbers and PIN numbers what information does someone need to spend money from my bank account without my consent? I want to list an item for sale on an auction website and if it sells the winning bid should be in the thousands. If I accept payment by bank transfer (due to potential rules regarding payment for this type of item) can the bidder use my bank account and routing numbers to spend money from my account?
This depends on which juridicsion or country you live in.
For example, here in sweden, its safe to give out bank account number and routing information, because to extract money, you will need a valid ID-card tied to someone that is authorized to access the account, and of course, bank personell will of course check the ID card throughly including calling the issuer to check if the ID card is barred.
In other countries, bank numbers are considered a "password", eg anyone that have it can pull money from account.
Also check your checks if you have check access. If the checks only lists your bank number and routing number, there is a possibly that someone could create a fake check with fake signature from you, and cash that check. Some other banks might include a security code or similar that will be cross-checked against the bank's computer system.
Same with bill paying. If bill-paying using only bank account and routing number is allowed from a remote location, then you are at risk, since someone only needs to fake your signature.
But for example in sweden, you always need to sign up for such services using a ID, and if those services aren't enabled on your account, its not possible for any outsider, that have access to bank number and routing info, to extract money from account.
The best you can do, is to open a unrelated bank account, at a second bank you normally isn't a customer in. This bank account, should have NO associated services, no checking account, no bill-payer service, nothing. Only way to get money out of the account should be physically visiting the bank office.
This account would then be safe to leave out. I don't know what happens if some attempts to cash a fake check for a bank account that has no checking access, but I think the accepting bank will notice the attempt immediately when their computers show the lack of checking access on the bank account.
HOWEVER: There is a second thing that is toublesome, regardless in which way you receive money. This is that someone, could, without your permission, depoist toublesome money in your account, for example money gained from a bank robbery or sales of narcotics. When investigation goes on, there is a possibility that all accounts you own, is frozen during the investigation. When a account is frozen, it means you have to apply to get your money for day-to-day living for example food and such.
So even if the security is so tight that only you can extract money from the account even if the whole world knows your bank account number, there is a possibility you can get in trouble if someone wants you in trouble.
This means, that regardless of the payment method you accept or use for the auction in question, you should carefully vet and check the winning buyer, before giving out information to the buyer that makes it possible for him to pay. If something is suspicious of the buyer, even if he have the money (Note! The money can be stolen! Not even cash is 100% safe to receive), then go for the next highest bidder.
In most auction sites, if you bid on a item, you are always obligated to pay the bid, even if someone overvid you, because also in most auction sites, the seller has the possibility to select who should win, he isn't required to sell to the highest bidder. (but of course, if the highest bidder is clean, theres no reason for the seller to lose money on selecing a low bidder).