5

Direct Debit or automatic debit transfer system or Bankeinzug (German), seems a common/convenient way to pay in (online shops in) many countries available for many banks.

https://en.wikipedia.org/wiki/Direct_debit

Thereby, ANYONE who gets "authorized" (or knows) your debit card credentials (BIC, IBAN, Account Holder Name) can withdraw a certain amount of money...

The authorization mechanism behind it is often trivial and not secure. In the best case it involves the owner to sign a contract at the bank, in the worst case its a checkbox in some online shop...

To the best of my knowledge, the "security-mechanisms" behind it are the following (for some German banks):

  • debit card credentials must be known (actually not a secret)
  • Transaction can be rolled back up to ~6 weeks after it happened
  • Max. transaction amount ~100€

So please help me here, If I see this correctly, but this seems very vulnerable to fraud... If so, please tell me a systematic/best-practise approach of mitigating it or some form of automatic fraud detection and notification that could be applied.

I know that some services like PayPal are using a form of authentication before the direct debit by challenging the bank account owner with a OTP in a small (1cent) transaction he has then to enter in the service....why is this not standard for direct debit.

Improve this question
6
  • Anecdotally, I worked at a company which looked at accepting direct debits about 10 years ago, and we decided against them due to concerns like this - there were distinctly fewer rules regarding them compared to payment cards, so software which supported their creation didn't need to meet standards, unlike with PCI. We were concerned about liability in the event of a breach, since some software options we saw literally stored these items of data in a web facing database.
    – Matthew
    Jun 3, 2016 at 7:55
  • These are banks! Banks do not care about security but about optimizing risks and costs. Are you asking as a user, as an online shop or as a bank?
    – cornelinux
    Jun 3, 2016 at 7:57
  • You mention "systemically" and "accounts", so certainly you are not asking from a user's perspective. Then whose? And in which country?
    – techraf
    Jun 3, 2016 at 8:01
  • Matthew thanks for sharing your anecdote. @cornelinux and techraf, I am asking from a German End-User perspective, I would like to know how to improve my personal security and fraud detection....because I am not willing to monitor my account all the time manually...maybe someone here has some practice with this and would like to share it...
    – Stilzk1n
    Jun 3, 2016 at 18:38
  • @techraf : Sepa is about all the Eurozone.
    – user2284570
    Jul 9, 2018 at 13:27

2 Answers 2

Reset to default
2

The system is safe by design: the best practice is to simply use the system's built‑in protection.

Unlike debit cards, you can ask your bank to enable a safe whitelist of IBAN account numbers allowed to withdraw from your IBAN. Any attempts to initiate a debit from an unauthorized account will result in payment rejections.

Though this option isn’t always available for online-only banks.

Improve this answer
4
  • reference : quechoisir.org/…
    – user2284570
    Sep 8, 2018 at 12:08
  • @user22845780 Thanks a lot, took 2 years for an answer. But how is the mechanism of adding IBANs to the whitelist working? If I click a checkbox in the payment process of some webshop, this is enough to whitelist the IBAN of the shop owner? How can I view the whitelist for my bank account?
    – Stilzk1n
    Sep 9, 2018 at 13:18
  • @Stilzk1n the only way is to go at your nearest bank office and ask to someone to set up the list. That is why it cannot be done with online banks (you cannnot manage it yourself).
    – user2284570
    Sep 9, 2018 at 14:14
  • 2
    Whitelists do not make the system "safe by design" (and the link does not support the idea of it being "safe by design"). Whitelists are a mitigation for a weakness in the system.
    – schroeder ♦
    Sep 9, 2018 at 14:42
0

The system is insecure by design: the best practice is to monitor your transactions every week and have a lawyer on standby to fight fraud.

I'm sorry to be the bearer of bad news, but the sad reality is that the existing financial system generally prefers to fight risk with law more often than cryptographic/technical protections.

For example, it's very common for "private keys" to be handed to the third party (trusting them to not commit fraud) and then have them pull from your account. That's how direct debit, credit card, and debit cards work.

If you want a system that actually secures your money, you should switch to a cryptocurrency where there is intentionally no concept of a direct debit. For example, in bitcoin all transactions are made by cryptographcally signing the transfer with your private key. There is no possibility for a third party to initiate a transfer taking money out of your account (wallet), and you never share your private keys.

That said, if you must use a traditional bank, try to find one with the following features:

  1. permits long passwords (some TradFi banks still only allow 4-digit numerical pins)
  2. Secure MFA (don't use SMS or email; TOTP or WebAuthn is preferred)
  3. Credential Reset is only possible with full KYC-level identity re-verification
  4. Direct Debit Allowlisting

I've not yet found a list of banks that support Direct Debit Allowlisting (where you block all Direct Debits, unless the specific IBAN that's taking your money is on a "whitelist"), but I have read some banks support this better than others. See also:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .