I called Chase business phone line today regarding my business bank account. All I had to enter in the automated menu was the account number and EIN. That's enough for them to tell you the balance, transaction history, etc. When I talked to an actual person, they also asked for my name and business name. None of these questions keep your account very secure. Account numbers are available to anyone that has ever received a check, and EIN's can often be publicly accessible too. Obviously name and business name are real easy.
I thought that they must only be allowing it because they recognize the number I'm calling from, but nope, tried from a different number and got through the exact same way.
Don't know if more secure data would be required for actions like withdraw, etc., but in any case, it seems like way too much access offered to anyone that so desires.