Currently, the only way to protect against ACH are detective controls which should be in place at the business and the bank. Most fraud gets detected after accounts get reconciled or after a customer complains that his account was used without authorization. In case of a bank, if a company only uses it for payroll payments and those payments occur once a month, transactions occuring outside the normal period should be looked into.
Consumers need to alert their institution within 60 days in order to recover funds. Businesses, however, only have as little as one business day. Therefore, monitoring becomes critical. Daily review of the credits and debits of the business is essential in detecting fraudulent activity.
Companies using ACH set up accounts that would either only accept ACH credits or issue them. As ACH expanded past the payroll, social security payment or repetitive bill-pay solution, moving into mainstream transactions, the direct relations were lost between the two parties and this opened a gate for fraud.
Common fraud schemes against the banks include setting up fake companies, getting on the ACH network, issuing lots of transactions to a single account and then emptying that account, leaving the bank behind with the losses. This is called ACH kiting.
Then there's also typical fraud where an attacker gets access to a company's network and just adds transactions in the transaction file or just executes transactions on behalf of the company.
Note that ACH was never designed to fullfil the task it's currently used for.