How can web apps prevent fraudsters from abusing ACH to steal from compromised bank accounts?

Two Factor Authentication using the mobile phone. The phone is the same phone that is registered with the genuine account holder.

Send a code on the phone in order to be able to do transactions online. Even if login credentials of the original bank account holder are stolen, they cannot execute a transaction in your web-app, because they would not have the mobile authorisation code.