Paying through bank transfer to other account without direct debit is more and more common these days.
Some of them are online services running bug bounties with availability of payment through bank transfer for the eurozone.

SEPA has a system since 2014 where one can take any amount of money from an IBAN (in that case, the IBAN/BIC code works like a credit card number).

Problem :

There is a protection against that which requires asking the bank to only allow direct debit from a specific set of IBAN from a chosen whitelist. But this protection is opt-in : by default, anyone can take any available amount with just knowing account numbers.
And in 2018 there’re still few bank employees that knows about the system (so when you open an A/P account, it is likely the employee or web site won’t tell you anything about the issue).

For example, if DE97120700883003416600 isn’t protected using account number whitelisting, then any IBAN/BIC can makes debits from DE97120700883003416600. Because DE97120700883003416600 is acting like a debit card number.
That’s why if whitelisting isn’t implemented there’s a security hole.
For implementing whitelisting for DE97120700883003416600, one would go to German bank (the bank responsible for DE97120700883003416600) to only allow a specific set of other account numbers for making direct debits.

How to test ?

In practice, nearly all services providing direct debit from IBAN accounts requires to proof account ownership. But this is not mandatory : for example, my ISP allows direct debits from bank accounts I don’t own (I tested it).
Though I cannot use my ISP to check if a bank account number is protected : most of the time, companies offering bug bounties open their bank accounts in Frankfurt, and my ISP is illegally requiring that IBAN must start with FR, thus requiring a French bank account for paying.

So how to test if direct debit whitelisting is implemented for a specific account number ?
The plan is to try withdraw a tiny amount of money and make a bug report eligible for bounty if the direct debit succeeds (provided the account belongs to a company with a bug bounty program).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.