IBAN’s are basically publicly available (like to pay bills, you just use the IBAN of the receiver, which doesnt change). So I imagine this requires authorization, otherwise everything would break.