3 ms·

> by making a payment out of it I fail to see the difference here. If I have your IBAN and you haven't universally disabled direct debit on your account I can

> by making a payment out of it I fail to see the difference here. If I have your IBAN and you haven't universally disabled direct debit on your account I can also use it to pay for something, for example by ordering anything I want from Amazon. > eg. with stripe Funny that you should mention Stripe specifically. You can accept SEPA direct debit payments with Stripe: https://stripe.com/docs/sources/sepa-debit https://stripe.com/docs/sources/sepa-debit It is possible that the compliance requirements around this are slightly higher than for accepting only Credit Cards, but looking at the documentation I don't see any indication of this. Further, credit/debit card payments are subject to SCA whereas direct debit is exempt from SCA if the mandate is given directly to the payee without involvement of their PSP.

logifail 5y ago
> If I have your IBAN [..] Bank account details aren't typically regarded as (worth keeping) secret, to the extent that many businesses are happy to stick their IBAN on their website. Credit card details, on the other hand, aren't ever published in this way.
- Cu3PO42 5y ago
  > Bank account details aren't typically regarded as (worth keeping) secret This is precisely my point. People are not terribly worried about others (including merchants) knowing their IBAN. They are worried about their credit card. However, a malicious actor can cause you much of the same trouble with your IBAN as they can with your credit card number. It is therefore illogical, in my opinion, to be worried about one much more than the other. > to the extent that many businesses are happy to stick their IBAN on their website. These accounts almost always block direct debit, therefore they don't run these risks.
  - logifail 5y ago
    > a malicious actor can cause you much of the same trouble with your IBAN as they can with your credit card number I disagree with this. A malicious actor may be able to cause some trouble if they have your IBAN, but it would appear to be significantly harder to steal money _and get away with the crime_ using an IBAN compared with someone's credit card details. In the Jeremy Clarkson story from 2008, someone set up a direct debit to a charity using bank account details. Given the hoops you have to jump through to be able to be able to set up a direct debit - and knowing that KYC would apply to the receiving bank account - it would appear to be significantly harder to profit from money withdrawn in this way. With a stolen credit card you can purchase something online from a merchant that isn't obliged to do any KYC checks and the fraudster is gone long before the crime is detected.

logifail 5y ago

> If I have your IBAN [..] Bank account details aren't typically regarded as (worth keeping) secret, to the extent that many businesses are happy to stick their IBAN on their website. Credit card details, on the other hand, aren't ever published in this way.

Cu3PO42 5y ago
> Bank account details aren't typically regarded as (worth keeping) secret This is precisely my point. People are not terribly worried about others (including merchants) knowing their IBAN. They are worried about their credit card. However, a malicious actor can cause you much of the same trouble with your IBAN as they can with your credit card number. It is therefore illogical, in my opinion, to be worried about one much more than the other. > to the extent that many businesses are happy to stick their IBAN on their website. These accounts almost always block direct debit, therefore they don't run these risks.
- logifail 5y ago
  > a malicious actor can cause you much of the same trouble with your IBAN as they can with your credit card number I disagree with this. A malicious actor may be able to cause some trouble if they have your IBAN, but it would appear to be significantly harder to steal money _and get away with the crime_ using an IBAN compared with someone's credit card details. In the Jeremy Clarkson story from 2008, someone set up a direct debit to a charity using bank account details. Given the hoops you have to jump through to be able to be able to set up a direct debit - and knowing that KYC would apply to the receiving bank account - it would appear to be significantly harder to profit from money withdrawn in this way. With a stolen credit card you can purchase something online from a merchant that isn't obliged to do any KYC checks and the fraudster is gone long before the crime is detected.