Is it really risky to make your IBAN public?

Question

It seems that people are reluctant to give their IBAN to strangers.

I saw someone downvoting an app only because it shows the IBAN in clear on the main screen.

Is this rational? What could someone do knowing your IBAN?

Answer 1

Apparently it varies between countries/banks. You should probably contact your bank and ask them.

There's a bit more information on this post. In there someone commented that in Germany you can make a direct debit from the account with IBAN number plus some basic personal information.

I live in Argentina. Recently I discovered it seems to work on a similar way here, but probably not every one can do it (I hope so). But my cable company started charging me after only giving them the IBAN number and my personal information (Name, last name, nationality and national id number*) and without the bank verifying I had accepted this (which I did. I hired the service and asked for the automatic debit).

* Sidenote: Argentinian DNI number (national identity document number) is the same for your whole life and it isn't meant to be kept private as I understand happens with US SSN. When you sign any contract you write down your name and your DNI, or when you pay by card, or when you register on almost any place call it gym/school/whatever. It's a very effective way to identify someone uniquely**. Most DNI's can be find freely on the internet.

** Unrelated cool info: Unluckily there had been cases of duplicated numbers, plus at it's beginnings they were supposed to be unique between male/female, which nowadays has changed. But some old people still have the same number than someone of the other gender (which most computer systems are not prepared for).

Answer 2

At least in Europe it may open a way to Direct Debit your account. Jeremy Clarkson had the same question as you but pushed it to an extreme.

Direct Debit officially requires you (the owner of the account) to send some paperwork to the bank allowing for DD from an organization. In practice they will allow withdrawal from your account and assume the risk of doing so. In case of any problems you will be immediately refunded.

The idea behind this is that 99.99% (a made up number) of people want the DD to happen and some of them will forget the paperwork. Which will create some issues when receiving a DD request form the organization. Which then requires action form the bank. The 0.01% of fraud is less costly, especially that DD is between banks, so easy to reverse.

Source: discussions with my banks after I forgot a few times to sent the paperwork and the DD went though (which I was happy with, but curious anyway)

Answer 3

At least in the UK an IBAN is just your domestic sort code/account number with the digits smashed together and a prefix added. I belive other countries are similar.

Unfortunately in the UK given someones sort code and account number it is possible to attempt to set up a fraudulent direct debit.

Yes these transactions can be reversed provided you spot them within 13 months, but it's still a pain calling up your bank, convincing them that you are you and convincing them to reverse the transaction and nothing prevents the fraudster from just setting up more fradulent direct debits.

(To clarify after a comment, when I say "setting up fradulent direct debits" I don't mean the fraudster collecting the direct debit money directly, just like most fraudsters won't bill a stolen credit card directly, I mean using the stolen details to procure goods or services)