Direct Debit or automatic debit transfer system or Bankeinzug (German), seems a common/convenient way to pay in (online shops in) many countries available for many banks.


Thereby, ANYONE who gets "authorized" (or knows) your debit card credentials (BIC, IBAN, Account Holder Name) can withdraw a certain amount of money...

The authorization mechanism behind it is often trivial and not secure. In the best case it involves the owner to sign a contract at the bank, in the worst case its a checkbox in some online shop...

To the best of my knowledge, the "security-mechanisms" behind it are the following (for some German banks):

  • debit card credentials must be known (actually not a secret)
  • Transaction can be rolled back up to ~6 weeks after it happened
  • Max. transaction amount ~100€

So please help me here, If I see this correctly, but this seems very vulnerable to fraud... If so, please tell me a systematic/best-practise approach of mitigating it or some form of automatic fraud detection and notification that could be applied.

I know that some services like PayPal are using a form of authentication before the direct debit by challenging the bank account owner with a OTP in a small (1cent) transaction he has then to enter in the service....why is this not standard for direct debit.

  • Anecdotally, I worked at a company which looked at accepting direct debits about 10 years ago, and we decided against them due to concerns like this - there were distinctly fewer rules regarding them compared to payment cards, so software which supported their creation didn't need to meet standards, unlike with PCI. We were concerned about liability in the event of a breach, since some software options we saw literally stored these items of data in a web facing database. – Matthew Jun 3 '16 at 7:55
  • These are banks! Banks do not care about security but about optimizing risks and costs. Are you asking as a user, as an online shop or as a bank? – cornelinux Jun 3 '16 at 7:57
  • You mention "systemically" and "accounts", so certainly you are not asking from a user's perspective. Then whose? And in which country? – techraf Jun 3 '16 at 8:01
  • Matthew thanks for sharing your anecdote. @cornelinux and techraf, I am asking from a German End-User perspective, I would like to know how to improve my personal security and fraud detection....because I am not willing to monitor my account all the time manually...maybe someone here has some practice with this and would like to share it... – Stilzk1n Jun 3 '16 at 18:38
  • @techraf : Sepa is about all the Eurozone. – user2284570 Jul 9 '18 at 13:27

The system is safe by design: the best practice is to simply use the system's built‑in protection.

Unlike debit cards, you can ask your bank to enable a safe whitelist of IBAN account numbers allowed to withdraw from your IBAN. Any attempts to initiate a debit from an unauthorized account will result in payment rejections.

Though this option isn’t always available for online-only banks.

  • reference : quechoisir.org/… – user2284570 Sep 8 '18 at 12:08
  • @user22845780 Thanks a lot, took 2 years for an answer. But how is the mechanism of adding IBANs to the whitelist working? If I click a checkbox in the payment process of some webshop, this is enough to whitelist the IBAN of the shop owner? How can I view the whitelist for my bank account? – Stilzk1n Sep 9 '18 at 13:18
  • @Stilzk1n the only way is to go at your nearest bank office and ask to someone to set up the list. That is why it cannot be done with online banks (you cannnot manage it yourself). – user2284570 Sep 9 '18 at 14:14
  • Whitelists do not make the system "safe by design" (and the link does not support the idea of it being "safe by design"). Whitelists are a mitigation for a weakness in the system. – schroeder Sep 9 '18 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.