I make payments to the benelux, france, germany, spain and poland, and they go all over the push mechanism. Direct debit is for utilities, and that's about it.
For fraud, my bank provides a gui with active agreements. While I can't cancel an agreement there, I can set a maximum frequency and amount. I put them at once per year max 0.0001 Euro until they get removed.
Non recurring payments over direct debit (Or even worse Clarna) is an instant no. I take another payment method. If grabbing money from my bank without my control is the only option, that's a red flag. I consider the company sleazy enough to go find a competitor, even if it raises the cost.
SEPA direct debit is a really really popular thing in Germany. Most utilities prefer (quite understandably) to pull from you instead of waiting for your transfer. Even landlords usually give you an agreement form to pull your rent out of your account.
I got used to that and recently tried to use a Polish bank account to pay on Amazon and surprisingly it didn't work. Amazon has sent me an automated email with a demand for a (push) transfer, sadly with added fee for the trouble.
Most people in Poland actually do transfers manually, direct debit is not really a thing. On the other hand there's this BLIK thing for instant transfers, even across banks.
It gives you a one-time-use 6-digit code that is valid for no more than two minutes. When the code is given to a merchant, either on line or in person, you get a popup with the amount and merchant name which you need to manually approve. You can give that code out over the phone to a family member who's currently at the store buying things for you, or to a child who's trying to get something for themselves. This is extremely convenient while still being secure, and it allows for secure payments on shared, malware-infested computers.
Some online services also give you the option to remember your device for future use. If you decide to do so, you will get a notification the next time you're trying to pay there, which you still need to approve. This is more convenient than typing in a code, while still being as secure.
This system is pretty resistant to fraud (you always need to approve the amount in your banking app), while allowing for irreversible payments, which merchants like.
This sounds like a great system, except that irreversible payment part. That’s only a feature for merchants and usually gets used to harm consumers in my experience.
In fact it's quite jarring when you have companies try to do something in Polish market and they don't do basic research into payment methods.
Take for example Luxxotica - I was buying some glasses as a gift yesterday, and they support two payment methods:
- card payment
- PayPal
Paypal hasn't been popular for years with all the other alternatives, and many people are wary of using cards to buy goods over the internet. In fact my card payment was blocked (which essentially never happens in any other methods) and I went to buy the glasses physically at a reseller.
Since few years banks also provide APIs for redirecting to transfer form prefilled with payment processor details, so you don't have to enter them manually.
That might be a function of Poland not being in the euro zone. AFAIK SEPA Direct Debit is only for transfers in Euro. Even if you tried to use a Euro bank account in Poland, either your bank or Amazon might not have bothered to implement it.
When they launched the SEPA direct debit option a couple years ago I tried it and the debit bounced back.
Eventually I did not have the need for marketplace instances anymore, then I tried it again and it worked.
Landlords benefit from it because it makes it harder for your to lower your rent in case there are issues with the place that warrant it. If they can withdraw the rent directly, you'd have to undo that payment, pay the lowered amount manually etc. which makes it more hassle for you and also increases the risk of screwing up.
You could sign a contract with your landlord, then revoke the so called "SEPA mandate" afterwards and you can forcibly switch to "manual payment" each month, since the SEPA mandate is not necessarily required or a "legally-necessary intrinsic component of the contract" (check for example: https://deutschesmietrecht.de/mietvertrag/662-mietzahlung-ei... )
Tough, depends on which type of relation you want to have to your landlord ;-)
Either way as a tenant it's best to do manual payments (even if they're automated on your end) each month so that lowering rent, if necessary, is straightforward.
It's supported by all major electronics stores. The only exception is Amazon who will do a SEPA pull instead. But there the bank grants you 6 weeks to cancel the deduction if you want to.
Giropay does in fact include fees, though these are usually covered by the seller. (check for example: https://www.unternehmerportal.info/giropay/)
DISCLAIMER: Lead Payment Engineer at an European Challenger Bank, i'm implementing that stuff in the backend, i'm mainly talking to our central bank.
I think the only party that can draw money directly from my bank account is my bank itself for my mortgage. For everything else, I have e-invoices, where the invoice comes directly to my bank account, so I receive a paper invoice maybe once a year from somewhere. And for e-invoices I can just set auto-accept limits, so any phone bill that is less than 10€ will get automatically accepted and for any phone bills greater than 10€, I need to manually accept it on my bank's website/app.
Actually, I have SEPA Direct Debit disabled on my bank account settings now that I checked it, so I guess I've never used it. I guess my bank just has direct access anyways for mortgage payments.
In general, "double scheme cards" (MC + Maestro on one card) should offer you the option to choose, while at the POS, which scheme should be used; the thing is, the merchant is not required to offer you this question, and there is a "default scheme" on such cards. This means, in cases the merchant does not ask you, the default scheme is chosen, which is usually the one that brings in more fees for the bank/PSP.
And: Depending on the contract between you and your bank, it maybe that you couldn't revoke the "lastschrift", yes.
It's getting rarer, though. The cost difference is eroding and signing is too slow for supermarket checkout lanes.
The tables have also turned and some retailers now earn money from the banks for supplying their customers with cash (i. e. you pay by card and get an extra x00 in cash).
SEPA SDD Core + SDD B2B are working crossborder; though you're right that these are not deployed regularly/seldom.
DISCLAIMER: Lead Payment Engineer at an European Challenger Bank, i'm implementing that stuff in the backend, i'm mainly talking to our central bank.
Here in Germany, bigger online stores offered it as well. I used to use it for Amazon several years ago.
Klarna's use of dark patterns on the web for leading people into debt over choosing other payment methods has been outlawed in Sweden, but I've read that they have continued doing it in other countries.
As a European that moved between countries, I was very surprised when I learned that SEPA allows a "pull" mechanism even exists. I lived 30 years in Latvia without knowing this is a feature in SEPA because every single payment is a "push" mechanism. I'm not sure if banks can turn this feature off, or if it just culturally never gained traction.
On the other hand, payments via banks are fairly widespread C2B, because every bank offers a (custom and horrible) API that merchants can implement. So users can authenticate directly with their bank as if it were PayPal, and authorize a SEPA payment to the merchant's bank account.
In fact, services that care about user identity, will often use these bank APIs to perform authentication with a high degree of confidence about the received user information.
Then I moved to France, and every bank interaction is "pull" based. While friction in Latvia came from authenticating before initiating the "push", in France the friction comes from agreeing to direct debiting, and signing various authorization slips. Sometimes electronically, but sometimes you have to send them by mail before you can start paying for a long-running service by bank (this makes it very undesirable for one-off purchases. In fact it is so cumbersome, that I prefer to pay for many services by credit card every month)
> I doubt the claims of very high fraud rate.
If I provide my account number to a service provider, they can debit it without me explicitly authorizing them (I have to sign an authorization usually, but there's nothing "technically" blocking the counterparty). I suppose that could lead to high fraud rates.
- PUSH: - SCT Standard - SCT Instant
- PULL: - SDD Core - SDD B2B
As a bank, you are not forced to support all of them; also, it depends on the local consumer behaviour: in some countries, pull mechanisms are not that widely accepted
DISCLAIMER: Lead Payment Engineer at an European Challenger Bank, i'm implementing that stuff in the backend, i'm mainly talking to our central bank.
Yes, the accounts in my bank (in Finland) default to SEPA Direct Debit off.
For recurring utility payments etc. we instead use Finvoice e-invoicing (https://www.finanssiala.fi/en/topics/finvoice-standard/). The customer enables e-invoices on a per-issuer basis directly from their bank web interface, with an option for auto-pay and payment limits. The payments are processed as regular SEPA payments. The e-invoice goes directly to customer's bank, replacing paper/e-mail invoices.
For paying one-time online purchases the user is redirected to their bank to authorize a one-time SEPA transfer (other non-SEPA payment methods like cards and MobilePay are common, too).
But explaining anything outside of the typically Dutch circumstances is an unfortunate part of life for the not typically Dutch in the Netherlands. Its a deeply cultural thing, this extreme hang towards conformation to a defacto 'normal'.
FYI: millions of Dutch have these kinds of problems. Look up the working poor, its a big group there. IMHO all native Dutch should be forced a few weeks internship with a budget council service, there are so many incorrect preconceptions about poverty. Including who it hits, which definitely includes people who thought they could never possibly be hit, did their finances right, etc.
How your bank presents (or doesn't present) a new SEPA mandate to you for approval is up to them. I'd guess that at least some of them never show you anything, and assume that you will notice and revoke the payment if it was unexpected or fraudulent.
Yes, but how well defined, or how loose, is that "authorization"?
Unfortunately, that depends on the implementation of security the bank adopted. I assume you are mentioning a detail in the PSD2 directive. The banks, especially after national legislation following the directive, may adapt but not overlap it.
Take as an example the rule in the directive, that NFC based payments should require PIN based confirmation every five transactions: not all banks implemented this.
There is also dynamic linking (ie you are shown the amount but also a unique code that the payment requestor also showed you) so you are confident it is the same transaction.
Phone and the gym are the only services that I do not pay by card, but not even by my choosing. Netflix gave me no option. Utilities are bulk included with the rent (transfer) so yeah, just those two.
Oh and I know the card number and codes by heart in case I need to buy anything. Verification is done by SMS.
You have to demand it. (Some of them will propose their solution.)
> if it just culturally never gained traction.
Very few people have read the PSD2 directive. (This friend of mine met a bank consultant who mixed it with a gaming console.)
Belarus, a country in Europe, but outside the EU and eurozone, aren't in SEPA . Romania, inside the EU but not in the eurozone, are in SEPA. Montenegro are outside of the EU and eurozone, use the euro, but aren't in SEPA.
Interesting. In my country (Finland) all banks that have joined the TIPS (SEPA Instant Settlement) always use it automatically if the destination bank supports it as well - at no extra charge to the account holder of course. Are you sure you are talking about TIPS / SCT Inst payments? Either way, your bank is not allowed to charge extra fees for cross-border SEPA transfers (as compared to domestic.)
So, TIPS is just one of the available clearing mechanisms available for the SEPA Inst scheme. (The other one is RT1, which is live a little bit longer)
Currently, there is no "regulatory forced" interoperability between RT1 and TIPS, though the 4CB are discussing it. (Esp. since RT1 is a private clearing mechanism, while TIPS is the one operated by the 4CB)
And, regarding fee: You are wrong - depending on the local jurisdiction (esp. consumer rights), a bank may for sure charge for processing SEPA SCT Instant messages. Over here, SEPA Instant transactions are around 0,50EUR - 1,00EUR, currently; some are also offering them for free.
DISCLAIMER: Lead Payment Engineer at an European Challenger Bank, i'm implementing that stuff in the backend, i'm mainly talking to our central bank.
They didn't say that banks cannot charge for SCT Instant.
They said that banks can't charge more for international than they do for domestic.
for sure i can charge you more for a SWIFT or T2 EU-transaction than i do for a SEPA EU-transaction.
Email seems at best no better to me, since why would I assume the address I use to speak to someone is the same one they use for their bank account? Or the particular bank account they want the money sent to?
So you enter an email address/phone number for them, and they receive a (presumably one time use, pre-set amount) link to retrieve money from you. That seems good. Ceteris paribus though (i.e. if both broadly implemented) I think I'd rather the recipient have the link where you go to pay, seems a bit odd to shift the onus on to the person you owe money to action it.
They’re free to send and receive.
Source: I worked on implementing Instant Payments at the biggest Dutch bank.
iDeal is of course the default for webshops, it’s big too.
But the 90% I referred to are “person to person” payments.
Did that two times already. They act real quick, out of a sudden :)
I think the claim is that because SEPA direct debits can be revoked within a very long window after settlement, it's more common that payments are revoked after goods/services have been provided (leaving businesses holding the bag). Whether this fits the precise definition of fraud I'm not sure, the payment was valid and successful, but later reversed. It would be a more interesting claim if there were some empirical comparisons included, but it certainly matches my experience.
Edited to add: another common form of fraud is somebody providing legitimate bank details of an unwitting victim. At least for some banks in Germany, the bank does not actually enforce authorisation from the account holder when a new direct debit mandate is introduced. The fraudster receives goods/services for free as long as the victim doesn't notice the charges.
From the consumers perspective though, at least where I live, direct debit is regarded as a secure and convenient method for recurring payments. A consumer can revoke a fraudulent payment within 8 weeks. It's as easy as clicking a button in your online banking. If the counterparty can not prove that it was explicitly authorized by the consumer to make SEPA Direct Debits, the payment can be revoked for up to 13 months.
it's fucking cheap for the merchant :-)
and with cheap, i mean, reeeeeaaalllyyyy cheap (well, depending on your PSP/etc.)
for a bank, the "purchasing costs" per one SEPA SDD at your central bank is in the fractions of the fractions of a cent. (you can check the rates on your local central bank website)
SEPA has several message types:
- SCT Standard is a push - SCT Inst is a push - SDD Core is a pull - SDD B2B is a pull
With SEPA payments fraud would cost the banks money so any company abusing it would be blacklisted.
Which is quite simple: First, its internaly only an exchange of liabilites in your balanace sheet.
Second, it does not involve any outgoing gateways/interfaces.
Third, if you are using a SaaS-corebanking-solution, those types of transactions are usually excluded in your contract.
From that perspective, it is absolutely useful.
Push Payment fraud presumably subsided enormously after they changed the rules so it's interactive. Now you provide account number and name, the banks algorithmically decide if the name you provided is correct and if not tell the sender there is a problem. So push fraudsters need a fake account name and that's harder. Passing KYC checks for some random mule is do-able but good luck persuading the bank your name is Big Corp Electricity so that the push fraud works.
In exchange, it saves a lot of time both for the customer and utility provider as the risks of mistakes are reduced considerably. Invoices get paid on time.
That said canceling a direct debit on your end even if it’s fraudulent isn’t something you should do as it can wreck your credit score in the UK since you’ll be in debt and depending on the account it can show up as a missed payment immediately even before it going to debt collector/judgement.
If there is a fraudulent transaction you have to contact the bank and file a claim.
(So that you have time to notice that someone has breached your account and stop them from emptying your accounts ?)
A normal SEPA payment, is a "push" affair. These have (for all intents and purposes, though not technically) been a thing ever since the euro was introduced, whereas SEPA Direct Debit is more recent, replacing many of the existing domestic direct debit schemes.
Then there's the Instant Payments bit: these are a thing but they're not used all that often (yet?). Most banks charge a hefty fee for an instant payment (mine charges €1.25). Some banks don't offer them at all. Adoption will grow and costs will decrease over time.
In most countries, payments within the same bank have been instant (and free) for a very long time. This is one of the reasons why many companies have accounts with multiple banks.
I'm sure some "weaker" european countries may have laxer fraud controls, but that's a temporary problem. ECB reporting is quite strict, and most banks do take fraud detection very seriously. Reputation is important for a bank, and if you're a truly disreputable bank you'll soon find yourself without friendly correspondent banks. Then you'll have a choice: fix your fraud problems, or become a useless island.