Dangerous Scenario

How hard would it be for a personnnel supervisor to wipe out an employee's checking account if this employee decided to enroll in direct deposit? In the companies that I have worked for, you need a voided check to initiate a direct deposit account. Who's to say that a corrupt personnel manager could not use the account number and routing number to purchase online items. Am I watching too much CSI? Or am I right in concluding doing things like this are very easy? Tell me what you think.