I am writing code to refund an ACH payment. For credit card refunds, all I provide is the last 4 characters of the credit card number and the original transaction ID. But for ACH refunds it appears that I must provide all of the original information including routing number, account number, account name and account type.
This seems like a bad security practice as I would need to keep this information inside the app rather than using what Authorize.net already has. Can someone confirm that my understanding is correct?
