In the EU, if you revoke their SEPA direct debit permission, they are committing a fraud if they try to pull money, and 99.9999% of companies will not even try. If someone still does it, you can revoke the transaction in your online banking interface, and the company will then have to pay an additional fee to the bank.
Netflix' fraud detection is garbage and someone created an account with random letters, some throwaway email and my bank account. I didn't notice until it was like three months in. For the two later transactions, I could reverse them immediately and the money was back in my account on the next business day.
The other one was outside of that window, but my bank filed a request with their bank and it took forever, but eventually they paid it back. I believe this works for something like 13 months. Beyond that, you could still sue the person (and their bank) who fraudulently debited money out of your account, but you don't get a default win.
So at least in Germany you have about a year to notice.
Experian routinely generates unauthorized credit card charges. The banks know, but they rely too heavily on the credit rating industry to stand up to them.
It was weird. They seemed very confused by the request.
If it's a Core SEPA Direct Debit, there is not the concept of a "signed mandate" but according to the rulebook [1] you have up to 13 months [2] to ask for a Return.
[_sigh_] I've spend so much team reading those rulebooks
[1] https://www.europeanpaymentscouncil.eu/what-we-do/sepa-payme...
[2] "If the request for a Refund concerns an Unauthorised Transaction, a Debtor must present its claim to the Debtor PSP within 13 months of the debit date. [...]"