It's very slow and they wait until its "in the bank". So the whole business model of Dwolla is low risk.

If they do ACH, it's never really settled, it just hasn't returned yet. Some classes of returns are limited to 3 days, some 60, and some can be clawed back a year later.

Their proprietary exchange might have different rules, but iirc, it's not very widely distributed yet.

What risk? They hold your money for half a week or more.

Unauthorized transaction returns can take 60 days. Even with the most iron clad auth agreement, people will still claim that it's unauthorized.