To be clear, Spotify is a _global_ company, and there is no excuse for this.

This isn't the reason why. Spotify has been a major player in the U.S. music streaming market for a long time. They have their own offices here, and these kinds of decisions are surely made domestically.

The reason for this is simply incompetence. They were given the order from leadership to discontinue Car Thing to cut costs, and they are given a short deadline with no options for extending or unlocking the hardware. Spotify's Lawyers don't see any way out of that issue, and also see liability for having discontinued a product so quickly and with such short notice, so they recommend to the Accounts team that Car Thing customers can opt-in to a refund, and that should indemnify Spotify from any disputes.

So the Accounts team gets this new recommendation from Legal, with an even tighter deadline than sunsetting Car Thing, where customers are entitled to refunds on-demand if they bought one. Requests come in immediately, and there is absolutely zero process in place for actually issuing refunds for this, so the Accounts team works directly with the Finance team and figures they can just wire refunds directly to customers, which the Finance team is happy to do if they are provided a spreadsheet of account/routing numbers.

Nobody in the process of making these decision has any understanding of the risks, they just move to actualize what leadership asked them to, doing as little work as possible to meet the deadline. The result is refund requests arriving before any refund process has been established, and so the process is invented on-the-fly without any regard to best practice.

Tl;Dr: Discontinuing Car Thing was a hastily made decision that was announced before the company had done due-diligence, and now they are dealing with a disorganized response.

SEPA Direct Debit is a thing here in Europe as well, this is why we could live just fine without credit cards for so long. We instead had our local variants of what y'all call ACH and a few cooperation networks, that got unified as part of the EU-wide SEPA rollout (must have been something like 10 years ago). Now you can do money transfers to and from the entirety of the EU between all banks, if you pay a bit extra most banks can actually do real-time nowadays. If someone does direct debit fraud with your account number, you can claw back the money just as easy as you can do with a credit card.

The only problem remains card-based POS transactions... unfortunately, MasterCard and VISA spent shit tons of money into lobbying to make sure people would finally all converge on their standard instead of an established domestic one, their closed network where these fuckers could finally get a chance at getting their cut from the 448 million EU citizens.

Fuck MC and VISA.