ANY company can do this including your employer. A dogshit group of villans I used to work for pulled money from an employee's bank account that had been deposited from a paycheck because he took two weeks vacation to train for a new job. Was it legal? Almost certainly not, but it happened.
After this happened to my friend, I set up my deposit account as a sort of shell account where anything that enters gets transferred by the bank into a separate account.