You can only PUT money in a bank account knowing the IBAN in Europe. Automatic payments have to be formally authorized first. Europeans give it their ibans without second thoughts, never heard of any such problems as in US.

It is called SEPA Direct Debit. You give people your IBAN, and they can take money from it. You formally have to give your permission of course (the "mandate"), but that is really a pinky promise by businesses that they have it. That there is not wide-spread abuse of this system seems to be because of accountability on who is granted access to this system.

I would imagine the situation in the US to be quite similar.