Direct Debit or automatic debit transfer system or Bankeinzug (German), seems a common/convenient way to pay in (online shops in) many countries available for many banks.
Thereby, ANYONE who gets "authorized" (or knows) your debit card credentials (BIC, IBAN, Account Holder Name) can withdraw a certain amount of money...
The authorization mechanism behind it is often trivial and not secure. In the best case it involves the owner to sign a contract at the bank, in the worst case its a checkbox in some online shop...
To the best of my knowledge, the "security-mechanisms" behind it are the following (for some German banks):
- debit card credentials must be known (actually not a secret)
- Transaction can be rolled back up to ~6 weeks after it happened
- Max. transaction amount ~100€
So please help me here, If I see this correctly, but this seems very vulnerable to fraud... If so, please tell me a systematic/best-practise approach of mitigating it or some form of automatic fraud detection and notification that could be applied.
I know that some services like PayPal are using a form of authentication before the direct debit by challenging the bank account owner with a OTP in a small (1cent) transaction he has then to enter in the service....why is this not standard for direct debit.