Forget fees, I once tried to buy something in the US from some stranger and he refused to give me his account number and accept a wire even if I paid for everything (and the sum was big enough that PP wouldn't be cheaper). The guy literally thought I want his number for some scam. "Only PayPal, please, it's secure, blah blah blah". Talk about culture shock.

It is useful to know that, in the US, if you have sufficient information to send a payment into an account you also have sufficient information to debit it. Americans are, accordingly, leery about giving out account numbers.

Americans are not historically leery about giving out checks but, fun fact, we put all the information needed to empty an account on every check.

Why? Long story; legacy systems rule the world. The industry's main defense is a) surveillance of use of accounts, b) reversing transactions which appear fraudulent, and c) aggressively prosecuting fraudsters where their identity can be readily ascertained.

The same is true in the UK, a direct debit instruction can be setup on an account using just the name, number and sort code, but it doesn't make us more wary, much in the same way that supplying one's home address is enough to take out lines of credit in that person's name

This sounds incredibly insecure, is it exploited much?

It's difficult to exploit Direct Debits, as you are entitled to a full and immediate refund: https://www.directdebit.co.uk/DirectDebitExplained/pages/dir...

As far as I know, the ability to use direct debits is not given to everyone. You can't just start making direct debits just because you have a bank account.

My guess is that it's the same as elsewhere in the EU: Your bank will reverse the charge if you ask it to, the risk stays almost entirely with the payee/the payee's bank.

To do this, your business requires permission from your bank. If you abuse it, your bank will probably revoke your permission.

>> It is useful to know that, in the US, if you have sufficient information to send a payment into an account you also have sufficient information to debit it.

Wait, what? The only thing needed to send a payment is a target account number. So, if banks in US consider that enough info to DEBIT the account then something went terribly wrong there. In Europe, to take money out of the account you need to either

- go to the bank, and show your photo ID to prove that you're you.

- login to online transaction system and prove your identity by knowing the login password and one-time SMS password.

That's why many charity institutions simply put their account number on their website and ask for donations - there's zero risk someone will debit their account.