Are you saying that all a customer has to do is call their bank and say they didn't authorize it, and the bank takes the money back from the merchant without question?
Without disclosing too much about my client; the last time we dealt with ACH disputes the following was standard procedure:
The customer calls their bank to dispute the withdrawal from their account. The customer is told to go to their branch to sign an affidavit, they sign it, and the funds are returned immediately. It matters not if the merchant has an authorization form with the customer's signature on it. If the customer claims it was fraudulent and signs an affidavit, the merchant loses the funds. The bank will not get involved in the dispute itself. It's up to the merchant to seek remedy in court by way of litigation.
Does that apply only to merchant-initiated ACH?
I've only have had experiences with merchant-initiated ACH. I can't speak for any other methods.
What about if the customer initiates the ACH from their bank's website? Most banks offer some sort of bill-pay service, which is sometimes processed electronically; some banks offer outgoing ACH directly; many others offer it through a service such as CashEdge's Popmoney.
Well, in Canada bill payments are technically not ACH. I'm pretty sure we have a separate facility for that here. I can't speak for the US's bill payment system.