the IRS statement on this topic is that there risk of fraud is too high to permit changes to banking account numbers. Note that other entities that have an online presence do have requirements about userids and passwords, two way authentication, challenge questions, email confirmation emails, etc. and other verification techniques that mitigate these risks. (note: the IRS, by policy, will never e-mail you, again because of the fraud risks)
The IRS does accept whatever you used on your tax returns - because they have a high confidence it's you providing the account information on a legal document (the tax return) as well as online tax preparers such as Turbo tax do have username and password processes to ensure "you are you". The stimulus situation creates a unique circumstance where a lot of time transpires between the time the tax return is submitted and the stimulus checks are cut - things change.
here is the IRS FAQ on the topic:
No. To help protect against potential fraud, the tool does not allow people to change direct deposit information already on file with the IRS.
If we issue a direct deposit and the bank information is invalid or the bank account has been closed, the bank will reject the deposit. We will then mail your Payment as soon as possible to the address we have on file for you, and we will update Get My Payment to reflect the date your payment will be mailed. Typically, once the payment is mailed, it will take up to 14 days to receive the payment, standard mailing time.
