Direct debit fraud and unauthorized debits

In a SEPA direct debit the creditor starts every collection, on the strength of a mandate that the creditor stores. The payer's bank does not see the mandate when the collection arrives. A collection based on a stolen name and IBAN therefore reaches the account in the same way as a genuine one, and the victim notices it on the statement.

The 2025 report on payment fraud by the EBA and the ECB splits the cases. Most direct debit fraud by value was unauthorized. In some half-years a large share by volume came from manipulating the payer into consenting to a direct debit: 67 percent in the second half of 2023, 45 percent in the first half of 2024. With about 74,000 cases in 2024, a few outliers move these shares.

Under section 675x of the Civil Code the payer can demand a refund of an authorized direct debit within eight weeks of the debit, and under the SEPA Core scheme no reason is needed. A collection without a mandate is unauthorized: the bank refunds it under section 675u, and the claim lapses if the payer does not report it within 13 months of the debit (section 676b). The SEPA B2B scheme gives no refund right for authorized collections.

The EBA and ECB report notes that for direct debits the reporting provider is the payee's provider and the user is the payee, and that the payer's refund right may explain why payees carry most losses in some countries. Many countries reported no direct debit losses, since a refund within eight weeks is not flagged as fraud by default.

A variable recurring payment turns the model around. The customer approves the consent once with strong customer authentication at their own bank, the bank enforces the limits on every payment, and the customer can revoke the consent in the banking app. A fraudster who only knows a name and an IBAN cannot create such a consent.

The SEPA counterpart is in preparation under the name Dynamic Recurring Payments, and the API access behind it is covered on the open banking in Germany page. Until then, most recurring euro bills arrive by direct debit, as the SEPA direct debit page notes.

Yes. A creditor needs a name and an IBAN to submit a collection, and the payer's bank does not check the mandate. The protection comes afterward: the eight-week refund under the SEPA Core scheme and the 13-month claim for a collection without a mandate.

Ask the bank to return it. Within eight weeks the bank refunds a SEPA Core collection without a reason; after that, report it as unauthorized within 13 months. A collection by an unknown creditor can also be reported to the police. The fraud prevention in Germany page names the blocking hotline 116 116 for online banking access.