Yes, a scammer with only your IBAN can take money from your account
Your IBAN (International Bank Account Number) is enough for someone to set up a direct debit against your account without your permission. In Germany, this is called a Lastschrift (direct debit), and it requires only your IBAN and name — not a PIN, not a signature, not your online banking password. A scammer can instruct their bank to pull money from your account, and your bank will process it unless you stop it.
This is different from card fraud or hacking your login. The scammer does not need access to your account at all. They straightforward use the IBAN you may have shared openly — on an invoice, a website, a social media profile, or even a business card — to create a debit instruction at their own bank.
The good news is that German law gives you strong protection after the fact. You can reverse almost any unauthorised direct debit, and your bank must refund you. But prevention and speed matter, because the window to act is limited.
Key Takeaways
- A scammer needs only your IBAN and name to set up a direct debit; they do not need your password, PIN, or permission.
- Your bank will process the debit unless you have blocked it in advance, but you can reverse it within eight weeks of the transaction date.
- The moment you notice an unauthorised debit, contact your bank by phone — email is slower and creates a record gap.
- German banks must refund unauthorised direct debits, but you must report them; the bank does not automatically reverse them.
- Sharing your IBAN on public platforms (websites, invoices, social media) is normal and safe — the risk comes from who you give it to, not the number itself.
How a direct debit scam actually works
The scammer obtains your IBAN and full name. This might happen because you posted it publicly, shared it in an email, or gave it to someone posing as legitimate. They then go to their own bank (or use an online service) and submit a direct debit instruction, claiming you owe them money for a service, product, or fine.
Your bank receives this instruction and checks only that the IBAN format is correct and the account exists. It does not verify that you authorised the debit or that you actually owe the money. The money leaves your account within one to three business days. You may not notice for weeks if you do not check your statement regularly.
Common scenarios include fake invoices for services you never ordered, fake utility bills, fake tax demands, or fake parking fines. The scammer counts on you not noticing quickly or not knowing you can reverse it.
What your bank must do if you report an unauthorised debit
German law (implemented through the Payment Services Directive) requires your bank to refund any direct debit you did not authorise. You do not have to prove the scammer's identity or intent — you only have to state that you did not authorise it.
The refund window is eight weeks from the date the money left your account. After eight weeks, your right to a refund becomes much weaker, though you may still have options through your bank's fraud team or through the police.
Your bank must process the refund within five business days of your report, though many do it faster. The money goes back into your account, and the scammer's bank is then responsible for pursuing the matter with them.
How to report an unauthorised direct debit to your bank
Call your bank when ready. Do not email first — a phone call creates an urgent record and lets you confirm details on the spot. Have your statement in front of you so you can give the exact amount, date, and the name or company the debit came from.
Tell the bank: "I did not authorise this direct debit and I want to report it as unauthorised." Use those words. The bank will ask for your account details and may ask basic questions about whether you recognise the company name or have any connection to them.
After the call, ask the bank to send you written confirmation of your report. Follow up with an email to your bank's fraud team with the same information, including the transaction date, amount, and the name it came from. Keep this email and any responses — you may need them later.
Do not wait for the bank to investigate on its own. Banks process refunds faster when you have clearly reported it as unauthorised rather than asking them to look into it.
Why sharing your IBAN is not inherently dangerous
Your IBAN is meant to be shared. Employers need it to pay your salary. Landlords need it to collect rent. Shops need it if you pay by direct debit. It appears on invoices and business websites. This is normal and safe.
The risk is not the IBAN itself — it is who you give it to and whether they are trustworthy. A scammer can misuse it, but so can a legitimate company if you authorise them and then they overcharge you or continue charging after you cancel.
You do not need to hide your IBAN or treat it like a password. You do need to be careful about who you send money to and which companies you authorise to take direct debits from your account.
Steps to take if you think you are being targeted
If you receive a suspicious invoice, bill, or demand for payment, do not ignore it and do not pay it. Check whether you actually owe the money by contacting the company directly using a phone number or website you find yourself — not a number in the suspicious document.
If you have already given your IBAN to someone you now distrust, you can ask your bank to flag your account for monitoring. Some banks offer this as a standard service. You can also set up alerts so you are notified of every debit, which helps you spot unauthorised transactions faster.
If you have been scammed once, scammers may try again. After you report and reverse the first debit, watch your statements closely for the next month. If another unauthorised debit appears, report it when ready — the pattern itself may help your bank identify the scammer.
What happens to the scammer after you report it
Once you report the debit as unauthorised, your bank refunds you and then pursues the scammer's bank. The scammer's bank is required to investigate and may freeze the account or pass the information to German police.
However, many scammers use temporary accounts, fake identities, or accounts opened in other countries. Your bank and the police will investigate, but recovery of the money beyond your refund is rare. The refund to you is may provide; catching the scammer is not.
You can file a police report (Anzeige) with your local police station or online through your state police website. Provide the transaction details, the name or company the debit came from, and any communication you received. This creates an official record and may help if the scammer targets others.
How to protect your account going forward
Monitor your bank statement weekly, not monthly. Most banks offer free online access and mobile apps that show transactions in real time. The faster you spot an unauthorised debit, the faster you can reverse it.
Be cautious about direct debit authorisations. When a company asks you to set up a direct debit, read the terms carefully. Know the amount, the frequency, and how to cancel. Many scams succeed because people authorise a debit and forget about it, then do not notice when the amount changes.
If you receive an unexpected bill or invoice, verify it before paying. Call the company using a number you find independently. Do not use contact details from the bill itself — scammers often include fake phone numbers.
Consider using a separate account for online shopping or subscriptions, with a lower balance. This limits the damage if that account is compromised.
Frequently Asked Questions
Can a scammer empty my entire account with just my IBAN?
Technically yes, but practically no. A scammer can set up a direct debit for any amount, but most banks flag unusually large debits or multiple debits from the same source. More importantly, you can reverse it within eight weeks, so the money does not stay gone. The real risk is not noticing quickly.
How long does it take to get my money back after I report it?
Your bank must refund you within five business days of your report. Many refund within one to two days. The money goes back into your account, and you can use it when ready. The bank then pursues the scammer's bank separately.
What if the scammer used a fake name on the direct debit?
Report it anyway. You do not need to know the scammer's real identity to reverse the debit. Your bank will refund you based on your report that it was unauthorised. The bank and police will investigate the fake name, but your refund does not depend on them finding the person.
Can I prevent direct debits from happening without my permission?
You cannot block all direct debits — legitimate companies need to be able to collect rent, utilities, and subscriptions. You can ask your bank to require your approval for each new direct debit instruction, though this slows down legitimate payments. The better approach is to monitor your statement closely and reverse anything unauthorised quickly.
Should I change my IBAN if I have been scammed?
No. Your bank will not change your IBAN, and you do not need a new one. Changing accounts creates more problems than it solves. Instead, reverse the fraudulent debit, monitor your statement, and report it to police. If the scammer tries again, you will catch it faster the second time.