Hacker News Reader

Comment by SimpleMinds | Hacker News Reader

Could you tell how knowing IBAN enables someone to take money from your account? As far as I understand, the only think that can happen with IBAN is to receive money.

Maybe you're thinking of credit card number? The CC's I had had different CC number and IBAN account.

View on HN

SEPA direct debit allows you to pull money via IBAN (+ BIC, depending on the countries involved in the transaction).

Specifics vary from country to country. Some require active approval from the customer (IIRC France, probably more), others "just work".

Fraud is not as common, since bank accounts that are allowed to debit money this way are generally only available to companies who have to sign paperwork ensuring that they have written permission from each debitor. Additionally, although this might be country-specific as well, chargebacks can be initiated without providing any reason for at least 8 weeks, and in case of a fraudulent transaction, up to 13 months.

Thanks, didn't know about that. Sounds like it's very specific version of account and most default accounts with IBAN doesn't have this possibility.

No, anyone’s account can be debited from, but only specific accounts can be debited to.

I can’t pull money from your account, even if you tell me your IBAN.

But I can use your IBAN to order from amazon, and then amazon can just pull however much they want from your account.

Luckily chargeback with direct debit works just as fast as with credit cards.

Thanks! That's something new that I didn't hear before. For interested parties seems [0] has some information. I need to check with my bank then to see how it works in my country.

[0] https://gocardless.com/guides/sepa/introduction/

Germany just works.

If you call a bank or another entity, that has your bank information on record, and claim to be someone specific, can answer basic questions and knows the full IBAN - perhaps they believe you are who you claim to be. This is social engineering, and it works.

I think parent specifically mentioned that just IBAN is enough which sounded very unprobable for me. Another comment explained that it's possible but in very specific accounts.

Reply on news.ycombinator.com