Yes, a scammer with only your IBAN can drain your account

A scammer who has your IBAN (Internationale Bankkontonummer) can initiate a direct debit against your account without your permission, and German banks will process it unless you stop them first. Your IBAN is enough; they do not need your PIN, your card, or your online banking password. The transaction can clear within one to two business days, and by the time you notice it, the money may already be gone.

This happens through a system called SEPA direct debit (Single Euro Payments Area), which is designed to let businesses and individuals pull money from your account with minimal friction. The system assumes good faith. It does not. A scammer can create a fake mandate — a document claiming you authorised them to take money — and submit it to their bank, which then submits it to yours. Your bank processes it because the IBAN is valid and the format is correct.

The good news is that German law gives you a strong right to reverse these transactions, but only if you act fast and know how to report it. Waiting weeks or hoping your bank will notice on its own will cost you the money.

Key Takeaways

  • A scammer needs only your IBAN to set up a fake SEPA direct debit and pull money from your account without your knowledge or permission.
  • German banks must process direct debits within one to two business days, so fraudulent transfers can clear before you see them.
  • You have the right to reverse an unauthorised direct debit within eight weeks of the transaction date, but you must report it to your bank immediately.
  • Your bank is required to refund you if you report a fraudulent direct debit within the legal window, even if the scammer has already spent the money.
  • Protecting your IBAN means treating it like a partial password — do not share it with unknown people, and be suspicious of requests for it outside normal payment contexts.

How SEPA direct debit makes your account vulnerable

SEPA direct debit is a payment method designed for recurring bills — rent, utilities, insurance, subscriptions. The payer (you) gives permission to the payee (the company) to pull money from your account on agreed dates. The system is fast and cheap, which is why it is standard across Europe.

The problem is that the mandate — the document proving you authorised the debit — is not verified by your bank before the transaction goes through. Your bank checks that the IBAN is real and formatted correctly, but it does not call you to confirm you actually signed the mandate. A scammer can forge a mandate, submit it to their bank under a fake business name, and their bank will send the debit request to yours. Your bank will process it because the technical details are correct.

Once the debit clears, the money moves to the scammer's account, often at a different bank or in a different country. By the time you notice the transaction on your statement, the money is already in motion.

What scammers do after they have your IBAN

Scammers obtain IBANs through phishing emails, fake websites, social engineering, or by simply asking you directly. Many people share their IBAN freely because it appears on invoices, business cards, and payment requests — it looks like public information. In some contexts it is; in others, it is a security risk.

Once a scammer has your IBAN, they can:

  • Create a fake SEPA direct debit mandate in your name and submit it to their bank.
  • Claim you owe them money for a service or product you never ordered.
  • Set up recurring debits so multiple transactions pull from your account over weeks or months.
  • Sell your IBAN to other scammers, who then attempt the same fraud.

They cannot log into your online banking, transfer money using your card, or access your account directly. But they do not need to. The direct debit system does the work for them.

How to stop a fraudulent direct debit immediately

If you see a transaction on your statement that you did not authorise, contact your bank the same day. Do not wait for the end of the week or the end of the month. Most German banks have a fraud hotline that operates during business hours and some operate 24/7. Look for the number on the back of your card or on your bank's website.

Tell the bank:

  • The date of the transaction.
  • The amount.
  • The name of the account it was pulled to (if you can see it on your statement).
  • That you did not authorise this debit and do not recognise the payee.

Your bank will place a hold on the transaction and begin an investigation. Under German law (implemented through the Payment Services Directive), your bank must refund you within a set timeframe if the debit was unauthorised. The refund is not may provide only if you wait too long to report it.

The eight-week window for reversing fraudulent debits

German law gives you eight weeks from the date the transaction cleared to report an unauthorised direct debit and demand a refund. This is a hard deadline. After eight weeks, your right to reverse the transaction expires, and your bank can refuse to refund you.

The clock starts the moment the money leaves your account, not the moment you discover it. If a scammer pulls money on the 15th of the month and you do not check your statement until the 1st of the next month, you have already used up two weeks of your eight-week window.

This is why monitoring your account regularly — at least weekly — is critical. Set up notifications on your phone for any transaction over a certain amount, or check your statement every few days. The faster you report fraud, the faster your bank can act and the higher the chance of recovery.

What happens after you report the fraud

Once you report an unauthorised direct debit, your bank will send a chargeback request to the scammer's bank. The scammer's bank then has a set number of days (usually 10 to 15 business days) to respond. If they cannot prove you authorised the debit, your bank will refund you.

In most cases, the scammer will not respond or will provide a forged mandate. When that happens, your bank refunds the full amount. You will see the money back in your account within one to two weeks after the chargeback window closes.

If the scammer's bank does respond with a mandate, your bank will ask you to confirm whether you signed it. If you did not, your bank will refund you and may report the fraud to German police (Polizei) or the federal financial regulator (BaFin). The scammer's bank may also freeze the account and report it to their own authorities.

In practice, most scammers operate from accounts that are already flagged or are closed shortly after the fraud is discovered. Recovery of the money itself is rare, but your refund is protected by law.

How to protect your IBAN from being misused

Your IBAN is not a secret like a password, but it is not public either. Treat it the way you would treat your mailing address — safe to share with people you trust for legitimate payments, but not something to post online or give to strangers.

Do not share your IBAN:

  • In response to unsolicited emails or phone calls, even if the caller claims to be from your bank or a government agency.
  • On social media or in public forums.
  • With anyone who contacts you first claiming you owe money or are owed money.
  • On websites that do not use HTTPS encryption (look for the padlock icon in your browser).

Do share your IBAN with:

  • Your employer (for salary payments).
  • Businesses you have an existing relationship with (utilities, insurance, subscriptions).
  • People you know personally who need to send you money.
  • Government agencies if you initiate contact and verify their phone number or website independently.

If you receive an email asking for your IBAN, verify the sender independently. Call the company directly using a phone number from their official website, not from the email. Scammers often impersonate banks and businesses with convincing-looking emails.

Frequently Asked Questions

Can my bank refuse to refund me if I report fraud after two weeks?

No. You have eight weeks from the transaction date to report unauthorised direct debits, and your bank must refund you if you report within that window. Two weeks is well within the legal timeframe. However, the sooner you report it, the sooner the investigation begins and the faster you get your money back.

What if the scammer's bank says I did authorise the debit?

Your bank will ask you to confirm whether you signed the mandate. If you did not, your bank will refund you. The burden of proof is on the scammer's bank to show a valid, signed mandate. A forged or unsigned document is not valid, and your bank knows this. You will not lose money because a scammer claims you authorised something you did not.

Can I get my money back if I report fraud after eight weeks?

Probably not. The eight-week deadline is a legal limit, and your bank can refuse to investigate or refund you after that point. In rare cases, if you can prove you were deliberately prevented from reporting (for example, if you were in hospital and unconscious), you may have grounds to appeal. But the standard answer is no — report fraud as soon as you see it.

Do I need to file a police report to get my money back from the bank?

No. Your bank will refund you based on the chargeback process alone. A police report is separate and is useful if you want to pursue criminal charges against the scammer, but it is not required for the bank refund. You can file a police report with your local Polizei if you wish, but do it after you have reported the fraud to your bank.

Can a scammer set up recurring debits with just my IBAN?

Yes. A scammer can submit multiple direct debit mandates to their bank, each one claiming you authorised a different recurring payment. Your bank will process each one until you report them as fraudulent. This is why monitoring your account weekly is important — you may catch a pattern of small debits before they add up to a large loss.