I have just learned that in Germany you pay online by providing your IBAN. In other words, anyone to whom I have sent money and therefore has my IBAN can extract money from my account. Apparently, the system somehow works and nobody questions it. From what I understood from other questions here, the situation is similar in U.S.
Given this fact, however, I find hard to understand the number of obstacles I need to overcome to make a simple transfer from my account to another account. I need to login to my online banking, create the order and then verify it, usually using a code sent via a text message (i.e. 2-factor authentication). Paying with a classic credit card is similarly complicated.
If anyone can pay just by providing my IBAN without no identity verification whatsoever and it is considered secure enough, why do I need to go through a complicated authentication and verification process to access my money on my account? To me it sounds like building a 12 feet tall wall around my house and then leaving the gate open 24/7. The wall makes my life complicated but brings zero improvement to my security.
I understand that the situation is somehow similar to credit card numbers. When someone gets hold of my credit card (or just the number), he can just start draining money from my account. But firstly online payments are very often protected by 2-factor and secondly, I've always approached credit card numbers as something which has to be kept in secret. IBAN on the other hand, is more like a phone number. If you want people to be able to send you money, you just give them your IBAN. But then it just feels strange to allow online payments just using IBAN.
Why is IBAN considered to be enough to make only payments? And since it apparently is, why bother and complicate our lives with 2-factor protection of online banking and credit card payments? What are the reasons that I'm missing?