Hacker News Reader

Comment by mitxela | Hacker News Reader

That's strange because all you need for direct debit authorisation is the account number and name, and a PNG image of a physical signature.

View on HN

In Japan, that authorisation needs to come together with an official certification, something that’s only valid for 3 months and you have to get it yourself from the local justice branch office.

Why don't we see more fraud using this technique?

That’s definitely not the case in Europe. There’s no way to start a debit operation out of my account other than:

1. Something electronic that kicks of the thing where I need to enter the “ID codes” from device or app; 2. Being present at the bank and having been ID’d;

There definitely is, that’s how SEPA direct debit works.

yeah. I am also unsure why we do not see more fraud here. Is it because of the 8 weeks of no questions asked refund possibility for payers and up to 13 months for unauthorized/fraudulent transactions? Or does the 5 business days lead time to get direct-debit play a role?

It is precisely because of the refund policy. It is so generous that, per my understanding, most SEPA direct debit fraud is abusing the refunds. Most banks do not require much supporting evidence for claiming the debit to be unauthorized, and unlike credit card disputes, the merchant doesn't even get to make a statement in the process.

Only if I allow it via banking website, while logged in (or come in person), right?

No, only a "recorded consent" is required, usually a physical signature or a record of you agreeing to this via online form.

So I can walk to a bank, speak to the teller, and withdraw from any account number by showing them that signature? I think not

Reply on news.ycombinator.com