14

It seems that people are reluctant to give their IBAN to strangers.

I saw someone downvoting an app only because it shows the IBAN in clear on the main screen.

Is this rational? What could someone do knowing your IBAN?

6

Apparently it varies between countries/banks. You should probably contact your bank and ask them.

There's a bit more information on this post. In there someone commented that in Germany you can make a direct debit from the account with IBAN number plus some basic personal information.

I live in Argentina. Recently I discovered it seems to work on a similar way here, but probably not every one can do it (I hope so). But my cable company started charging me after only giving them the IBAN number and my personal information (Name, last name, nationality and national id number*) and without the bank verifying I had accepted this (which I did. I hired the service and asked for the automatic debit).

* Sidenote: Argentinian DNI number (national identity document number) is the same for your whole life and it isn't meant to be kept private as I understand happens with US SSN. When you sign any contract you write down your name and your DNI, or when you pay by card, or when you register on almost any place call it gym/school/whatever. It's a very effective way to identify someone uniquely**. Most DNI's can be find freely on the internet.

** Unrelated cool info: Unluckily there had been cases of duplicated numbers, plus at it's beginnings they were supposed to be unique between male/female, which nowadays has changed. But some old people still have the same number than someone of the other gender (which most computer systems are not prepared for).

5

At least in Europe it may open a way to Direct Debit your account. Jeremy Clarkson had the same question as you but pushed it to an extreme.

Direct Debit officially requires you (the owner of the account) to send some paperwork to the bank allowing for DD from an organization. In practice they will allow withdrawal from your account and assume the risk of doing so. In case of any problems you will be immediately refunded.

The idea behind this is that 99.99% (a made up number) of people want the DD to happen and some of them will forget the paperwork. Which will create some issues when receiving a DD request form the organization. Which then requires action form the bank. The 0.01% of fraud is less costly, especially that DD is between banks, so easy to reverse.

Source: discussions with my banks after I forgot a few times to sent the paperwork and the DD went though (which I was happy with, but curious anyway)

  • You rarely (if ever) sent the authorisation to your bank directly, but to the company that wanted to collect Direct Debits, who would then forward it to your bank. However, since the introduction of AUDDIS (Automated Direct Debit Instruction Service) some years ago, all new DD instructions are forwarded electronically. – TripeHound Jul 17 '18 at 21:05
  • 1
    I think the type of fraud Jemery Clarkson encountered may be possible in Germany as well. However, I think it worth while that this was different from "normal" fraud in that while the money left Clarkson's account without him knowing or authorizing this, it was not sent to the fraudster's account but to a third party who has special direct debit authorization. The usual type of fraud where the point is that primarily someone wants to get money (rather than primarily aiming at making so else loose money) would leave the bank in perfect knowledge who got the money. – cbeleites Jul 17 '18 at 21:11
  • Which really is pretty much the same as credit card fraud. No smart fraudster steals money directly to a bank account in their own name, they steer the value through sufficient intermediate transactions (including potentially buying goods/services for resale) that the trail is difficult to follow. – Peter Green Jan 15 at 13:09
  • @PeterGreen: probably (don't know enough about the receiving side of credit cards but I guess it is similar). The banks over here won't accredit you to initiate direct debits without proof that you can meet cancelation (which is right of the account owner from whom money is withdrawn the bank guarantees) of any direct debit you did initiate (e.g. limit the amount you can "pull"/demand a deposit) and reserve the right to cancel/hold your acceditation anytime they think something suspicious is going on. – cbeleites Jan 15 at 17:10
1

At least in the UK an IBAN is just your domestic sort code/account number with the digits smashed together and a prefix added. I belive other countries are similar.

Unfortunately in the UK given someones sort code and account number it is possible to attempt to set up a fraudulent direct debit.

Yes these transactions can be reversed provided you spot them within 13 months, but it's still a pain calling up your bank, convincing them that you are you and convincing them to reverse the transaction and nothing prevents the fraudster from just setting up more fradulent direct debits.

(To clarify after a comment, when I say "setting up fradulent direct debits" I don't mean the fraudster collecting the direct debit money directly, just like most fraudsters won't bill a stolen credit card directly, I mean using the stolen details to procure goods or services)

  • 3
    You are, perhaps, being a little over-dramatic with "nothing prevents the fraudster from just setting up more fradulent direct debits". A person/company cannot just "start collecting Direct Debits"... as per BACS's Getting Started page, you have to pass "checks for integrity, financial standing and administrative capability" -- which may involve depositing a "bond" to cover misuse. A company abusing the system would have their ability to collect DDs withdrawn. – TripeHound Jul 17 '18 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.