The article misrepresents how direct debit works. Just having your bank details is absolutely not enough to initiate a transfer: the user must confirm it by issuing so called direct debit mandate. This mandate usually has a limit on the amount, and can be revoked at any time. Also, the business faces penalties for repeated failed transfers.