What scammers can do with your IBAN alone
A scammer with only your IBAN (International Bank Account Number) cannot log into your account, transfer money out, or access your balance. They cannot drain your account or steal your identity with that number alone. Your IBAN is designed to receive money, not to authorize payments out of your account.
What they can do is initiate a SEPA Direct Debit (Lastschrift) against your account. This is the real risk. A direct debit is a standing instruction that lets someone pull money from your account on a recurring or one-time basis. If a scammer has your IBAN and your name, they can submit a direct debit mandate to their bank claiming you authorized it. Your bank will process it unless you have already set up blocks, or unless you dispute it afterward.
The second risk is that your IBAN becomes part of a larger data set. Scammers often combine an IBAN with other details—your name, email, phone number, or address—to build a convincing phishing attack or to sell your information to other criminals. The IBAN itself is not the weapon; it is the starting point.
Key Takeaways
- A scammer cannot log into your account or transfer money out using only your IBAN, because your IBAN does not grant authorization to withdraw funds.
- The main risk is a fraudulent SEPA Direct Debit, where a scammer submits a mandate claiming you authorized recurring or one-time payments from your account.
- Your bank will process a direct debit unless you have set up a block in advance or dispute the transaction after it posts.
- An IBAN combined with your name and other personal details becomes a tool for phishing, social engineering, or sale to other criminals.
- German banks and the Bundesbank do not require you to keep your IBAN secret the way you would keep a PIN or password secret.
How SEPA Direct Debit fraud works in Germany
A SEPA Direct Debit (Lastschrift) is a payment method where the creditor (the person or company receiving money) initiates the pull from your account, rather than you pushing money to them. This is common in Germany for utilities, insurance, subscriptions, and rent. The system assumes the debtor has authorized the creditor to do this.
A scammer can submit a direct debit mandate to their own bank using your IBAN and name. They do not need your password, your PIN, or your permission. Their bank will send the instruction to your bank through the SEPA network. Your bank will check whether the IBAN and name match an account in their system. If they do, the payment is processed. You will see it on your statement days later.
This is why direct debit fraud is the primary concern when your IBAN is exposed. The scammer does not need to break into your account; they use the payment system itself as the attack vector.
What stops a direct debit from going through
Your bank can reject a direct debit at the point of processing if you have set up a direct debit block (Lastschriftsperre) in advance. This is a standing instruction that tells your bank to refuse all direct debits from your account. You can set this up through your online banking portal or by visiting your branch. Once active, no direct debit will be processed unless you remove the block.
The downside is that a blanket block stops legitimate direct debits too—your utilities, insurance, and rent payments will all fail. Most people do not use this option unless they are actively being targeted or are traveling and want extra protection.
The more practical defense is to dispute the transaction after it posts. German law gives you the right to reverse a direct debit within eight weeks if you did not authorize it. You contact your bank, report the transaction as unauthorized, and your bank will refund the money and investigate. The burden is on the creditor (the scammer's bank) to prove you authorized the debit. In most cases, they cannot, and the reversal is granted.
Why your IBAN is not like your account number in other countries
In Germany and across the EU, the IBAN replaced the older bank account number system. The IBAN is a standardized, publicly shareable number. It appears on your invoices, your business cards, and your bank statements. You are expected to give it to anyone who needs to send you money—employers, clients, refund departments, government agencies.
Because the IBAN is designed to receive money, not to authorize outgoing payments, German banks do not treat it as a secret. You do not need to hide your IBAN the way you would hide a credit card number or a PIN. This is by design: the system assumes that receiving money is low-risk, and that outgoing payments require separate authorization.
This is different from some other countries where account numbers are treated as more sensitive. In Germany, the sensitivity lies elsewhere—in your PIN, your online banking password, and your TAN (transaction authentication number).
What information a scammer needs to cause real damage
An IBAN alone is not enough to drain your account. A scammer needs one of the following to cause serious damage:
- Your online banking login and password: This grants access to your account and allows them to transfer money, change settings, and see your balance.
- Your card details (number, expiry, CVV): This allows them to make card payments or online purchases in your name.
- Your IBAN plus a fraudulent direct debit mandate: This allows them to pull money from your account, but you can dispute it within eight weeks.
- Your IBAN plus your name plus other personal details: This allows them to build a phishing attack or social engineering scheme to trick you into revealing more sensitive information.
The IBAN is the least sensitive of these. It is a necessary part of the payment ecosystem, and you are expected to share it freely.
Steps to take if your IBAN has been exposed
If you know your IBAN has been shared with a scammer or posted online, you do not need to close your account or panic. Start by checking your recent transactions for any unauthorized direct debits. Look at your bank statement for the past 30 days and flag anything you do not recognize.
If you find unauthorized transactions, contact your bank immediately. Report them as fraudulent, and your bank will begin the reversal process. You have up to eight weeks to dispute a direct debit, so you have time to act.
If you have not seen any fraudulent activity but want to be cautious, you can set up a direct debit block temporarily. This stops all direct debits for a set period. You can remove it once you feel the risk has passed. Ask your bank how to do this—most offer it through online banking or by phone.
Monitor your account regularly for the next few months. Set up notifications for any transactions if your bank offers them. Many German banks allow you to receive SMS or email alerts when money leaves your account, which gives you early warning of fraud.
Do not change your IBAN or close your account unless your bank advises it. Changing your IBAN is disruptive and unnecessary in most cases. Your bank has fraud detection systems in place, and they can investigate and reverse unauthorized transactions.
How to protect your IBAN going forward
Since your IBAN is meant to be shared, the focus should be on protecting the information that matters: your password, your PIN, and your personal details.
Be cautious about where you enter your IBAN online. Use only secure, encrypted websites (look for the padlock icon in your browser). Do not enter your IBAN into unsolicited emails, text messages, or pop-up windows, even if they claim to be from your bank. Your bank already has your IBAN.
Be skeptical of requests for your IBAN combined with requests for other information—your date of birth, your mother's maiden name, your email password, or your online banking credentials. Legitimate companies do not ask for these together. This is a sign of a phishing or social engineering attack.
If you receive a direct debit notification from your bank for a company you do not recognize, contact your bank before the payment is processed. Many banks allow you to block a specific direct debit before it clears. Acting quickly can stop the fraud before your money leaves your account.
Frequently Asked Questions
Can someone transfer money out of my account if they only have my IBAN?
No. An IBAN is designed to receive money, not to authorize outgoing transfers. To transfer money out, a scammer would need your online banking login, your card details, or a fraudulent direct debit mandate. The IBAN alone does not grant that access.
What should I do if I see a direct debit I did not authorize?
Contact your bank immediately and report it as unauthorized. You have up to eight weeks to dispute a direct debit under German law. Your bank will refund the money and investigate. Keep records of your dispute and any communication with the scammer or their company.
Do I need to close my account if my IBAN was leaked?
No. Closing your account is disruptive and unnecessary. Instead, monitor your transactions closely for the next few months and set up transaction alerts if your bank offers them. If fraudulent activity appears, report it immediately. Your bank can investigate and reverse unauthorized payments.
Is it safe to put my IBAN on an invoice or business card?
Yes. Your IBAN is meant to be public. People need it to send you money. This is standard practice in Germany and across the EU. The risk comes from sharing other information—your password, PIN, or personal details—not from sharing your IBAN.
What is the difference between a direct debit block and disputing a transaction?
A direct debit block (Lastschriftsperre) stops all future direct debits before they are processed. Disputing a transaction reverses a direct debit that has already been charged to your account. A block is preventive; a dispute is reactive. Most people use disputes because a blanket block would also stop legitimate payments.