In the US, automated payments tend to be "pull based", where a company tells your bank "give me this much from this account, I have permission". The company can lie but, by the time you find out, the money is already gone and it can take a long time to get it back. The bank has no real incentive to get your money back.

With a credit card, on the other hand, you see what was taken _before_ you pay them. So you can tell the credit card company "this amount that was charged to me is not me, I'm not paying that". Then the credit card company has to look into it; they have incentive to figure out what happened (unlike banks) because they aren't getting payed back their "loan" to you until they do.

In India, now you have to approve all such scheduled payments with a 2FA and upto a limit. So even if I have approved ShadyCorp they can't demand more than approved amount.

Dutch banks used to work like that too, by "incasso", and in fact still do to some extent. But any incasso that hasn't been directly authorised by you with the bank can be undone (and apparently at an additional fee to the company that originated it; they really don't like it when that happens). So that's actually very similar to how credit cards work, but without the additional fee. These days you can easily manage all upcoming incassos through your banking app and block them before they happen, though I generally prefer to pay such recurring payments through automated "push" transfer.

The problem is that since direct debits are so easily reversible, in Germany they are not seen as a final form of payment (until the charge return time limit expires) as there is no form of dispute arbitration involved.

Merchants will usually not ship goods or provide services for a direct debit alone.

In Netherland incasso is mostly used for recurring membership fees, not the purchase of goods. Those are generally done through a direct, authorised transaction, which isn't so easily reversible.

> The big problem with credit cards is that all the info needed to authorize a transaction is right there on the card. The second problem is that quite often you submit that data directly to the merchant or to whichever payment provider the merchant chose.

Same with my (UK) DD card, when I use it online. I occasionally get challenged by Visa/Mastercard for some passphrase or whatever. For retail purchases, I can usually just swipe. Periodically I'm asked for a PIN.

I prefer DD over CC, because I have full control over my liabilities, should someone try to drain my account, just by adjusting the balance on the account (and I can't link my deposit account with the card; so that's where the rich pickings are kept).

Also, way back when, I was pretty relaxed about credit balances, and the CC company kept raising my limits; I got into a lot of debt. Nowadays I don't use credit unless I'm forced to (which hasn't happened for 20 years). So I have a CC, with a zero balance (and the CC company is going to shut it down, because I'm not using it).

A gun to ones head is one universal way to drain any bank account or bitcoin wallet.

AFAIK none of the banks will reverse this activity, since technically you've authorised this transaction.

Technical exploits are only a subset of fraud. Scams bypass 2FA with no problems.