Direct Debit or automatic debit transfer system or Bankeinzug (German), seems a common/convenient way to pay in (online shops in) many countries available for many banks.
https://en.wikipedia.org/wiki/Direct_debit
Thereby, ANYONE who gets "authorized" (or knows) your debit card credentials (BIC, IBAN, Account Holder Name) can withdraw a certain amount of money...
The authorization mechanism behind it is often trivial and not secure. In the best case it involves the owner to sign a contract at the bank, in the worst case its a checkbox in some online shop...
To the best of my knowledge, the "security-mechanisms" behind it are the following (for some German banks):
- debit card credentials must be known (actually not a secret)
- Transaction can be rolled back up to ~6 weeks after it happened
- Max. transaction amount ~100€
So please help me here, If I see this correctly, but this seems very vulnerable to fraud... If so, please tell me a systematic/best-practise approach of mitigating it or some form of automatic fraud detection and notification that could be applied.
I know that some services like PayPal are using a form of authentication before the direct debit by challenging the bank account owner with a OTP in a small (1cent) transaction he has then to enter in the service....why is this not standard for direct debit.