The same is true in the UK, a direct debit instruction can be setup on an account using just the name, number and sort code, but it doesn't make us more wary, much in the same way that supplying one's home address is enough to take out lines of credit in that person's name

This sounds incredibly insecure, is it exploited much?

It's difficult to exploit Direct Debits, as you are entitled to a full and immediate refund: https://www.directdebit.co.uk/DirectDebitExplained/pages/dir...

As far as I know, the ability to use direct debits is not given to everyone. You can't just start making direct debits just because you have a bank account.

My guess is that it's the same as elsewhere in the EU: Your bank will reverse the charge if you ask it to, the risk stays almost entirely with the payee/the payee's bank.

To do this, your business requires permission from your bank. If you abuse it, your bank will probably revoke your permission.

>> It is useful to know that, in the US, if you have sufficient information to send a payment into an account you also have sufficient information to debit it.

Wait, what? The only thing needed to send a payment is a target account number. So, if banks in US consider that enough info to DEBIT the account then something went terribly wrong there. In Europe, to take money out of the account you need to either

- go to the bank, and show your photo ID to prove that you're you.

- login to online transaction system and prove your identity by knowing the login password and one-time SMS password.

That's why many charity institutions simply put their account number on their website and ask for donations - there's zero risk someone will debit their account.