What scammers can actually do with your IBAN alone

A scammer with only your IBAN can set up a direct debit (called a Lastschrift in German banking) against your account without your permission. They cannot log in, cannot see your balance, and cannot transfer money out directly — but they can instruct their bank to pull money from your account on a specific date. This is the real risk, and it is why your IBAN is treated as sensitive information in Germany, even though it is not secret in the way a PIN or password is.

Your IBAN is designed to be shared. You give it to employers for salary deposits, to utilities for bill payments, to friends who want to send you money. The problem is that anyone with it can also request a direct debit, and the German banking system assumes good faith at the point of the request. Your bank will not call you to confirm that you authorised a direct debit from a stranger — they process it, and you catch it later when you see the transaction.

The second thing a scammer cannot do is important: they cannot access your online banking, cannot see what is in your account, and cannot make a wire transfer (called an Überweisung) on your behalf. Those require authentication — a PIN, a password, or a second factor. An IBAN alone does not give them that.

Key Takeaways

  • A scammer with your IBAN can set up a direct debit to pull money from your account, but cannot log into your online banking or see your balance.
  • Direct debits in Germany are processed first and verified later, so fraudulent ones will hit your account before you can stop them.
  • You can dispute a fraudulent direct debit with your bank within eight weeks of the transaction date, and the bank must refund you while they investigate.
  • Protecting your IBAN means being cautious about where you share it and checking your statements regularly for unfamiliar direct debits.
  • If a scammer has your IBAN and other personal details like your name and address, the risk of fraud increases significantly.

How direct debit fraud works in the German system

When you set up a direct debit with a company in Germany — say, your internet provider or gym — you give them your IBAN and sign a mandate. That mandate is the permission slip. A scammer with only your IBAN does not have a signed mandate, but they can forge one or claim one exists. They send the forged mandate to their bank, their bank sends it to yours, and your bank processes the debit.

The German banking system is built on the assumption that if a mandate exists, the debit is legitimate. Your bank does not verify the signature or contact you before pulling the money. They pull first, and if you dispute it, they investigate after. This is called the Lastschrift-Rückgabe process — the direct debit reversal — and it is your protection, but it is reactive, not preventive.

A scammer typically uses this method when they have your full name and address along with your IBAN. The IBAN alone is not enough to make the fraud convincing; they need the other details to make the mandate look real. If you have shared your IBAN in a public place or with someone you do not trust, and they also have your name and address, the risk is real.

What happens if a fraudulent direct debit hits your account

You will see the transaction in your online banking or on your statement. The debit will show the name of the company or person who initiated it, though scammers often use fake business names to make it look legitimate. Once you spot it, you have eight weeks from the date of the transaction to dispute it with your bank.

Contact your bank when ready — do not wait. Tell them the direct debit was not authorised by you. Your bank will reverse the transaction (put the money back) while they investigate. During the investigation, they will ask the scammer's bank for proof of the mandate. If the scammer cannot produce a valid, signed mandate, your bank will keep the money in your account. If the scammer's bank cannot be reached or does not respond, your bank will keep the money anyway.

The eight-week window is important. After eight weeks, you lose the right to dispute under German banking law. Mark your calendar or set a phone reminder if you see something suspicious. Some banks offer alerts for direct debits over a certain amount, which can help you catch fraud faster.

Steps to take if you think your IBAN has been compromised

First, check your last three months of statements for direct debits you do not recognise. Look for small amounts — scammers sometimes test with a small debit first to see if you will notice. If you find one, dispute it when ready with your bank using the process above.

Second, contact your bank and ask if you can set up a Lastschrift-Sperre (direct debit block). This is a restriction that prevents any new direct debits from being processed against your account. Some banks offer this as a standard feature; others charge a small fee or require you to request it in writing. A block is not permanent — you can lift it when you need to set up a legitimate direct debit — but it stops opportunistic fraud while you sort things out.

Third, if the scammer has other personal information about you (your full name, address, phone number, email), consider reporting the fraud to the Bundeskriminalamt (Federal Criminal Police Office) or your local police. You can file a report online at www.polizei.de or in person at your local precinct. This creates a record and may help if the scammer targets others.

Fourth, monitor your credit file. You can request a free credit report once a year from Schufa, the main credit bureau in Germany. Go to www.meineschufa.de and request your Selbstauskunft (self-disclosure). Check it for accounts or inquiries you did not make.

Where your IBAN is safe to share and where it is not

Your IBAN is safe to share with banks, employers, government agencies, and established companies you do business with. These organisations have systems in place to prevent fraud, and they have no incentive to steal from you. You should share it freely in these contexts.

Your IBAN is not safe to share in public forums, on social media, or with people you do not know. Do not post it in online classifieds, do not text it to someone you met once, and do not include it in an email to someone who contacted you out of the blue. Scammers trawl public spaces looking for IBANs, and they combine them with names and addresses harvested from other sources.

Be especially cautious if someone contacts you claiming to be from your bank, a government office, or a company you use, and asks for your IBAN. Legitimate organisations already have your IBAN or can look it up in their system. If someone is asking for it, they are probably not who they say they are. Hang up, call the organisation directly using a number from their official website, and ask if they contacted you.

The difference between IBAN fraud and other account takeovers

IBAN fraud (direct debit fraud) is different from account takeover, where a scammer logs into your online banking and empties your account. Account takeover requires your username, password, and usually a second authentication factor. An IBAN alone cannot get them in.

IBAN fraud is also different from wire transfer fraud, where a scammer tricks you into sending them money directly. In that case, you are the one initiating the transfer, and once the money leaves your account, it is much harder to recover. With direct debit fraud, the scammer is pulling money out, and you have the eight-week dispute window to get it back.

The reason IBAN fraud is a real concern in Germany is that the direct debit system is designed for convenience and trust, not for fraud prevention at the point of transaction. Other countries have stricter verification processes for direct debits, but Germany prioritises speed. Understanding this difference helps you know what to watch for and how to respond.

How to reduce your risk going forward

Check your bank statements at least once a month, ideally more often. Most banks let you view transactions online within a day or two of posting. The faster you spot a fraudulent direct debit, the faster you can dispute it. Set a calendar reminder if checking statements does not come naturally to you.

Use different passwords for different accounts, and use a password manager to keep track of them. If a scammer has your email address and password from a data breach at another company, they might try to log into your online banking. A unique, strong password makes this much harder.

Enable two-factor authentication on your online banking if your bank offers it. This usually means you get a code on your phone or through an app when you log in. Even if a scammer has your password, they cannot get in without this second factor.

Be cautious about what personal information you share online. The more a scammer knows about you (name, address, phone number, employer), the more convincing they can make a fraudulent direct debit mandate look. Do not overshare on social media, and be selective about who you give your address to.

Frequently Asked Questions

Can a scammer transfer money out of my account if they only have my IBAN?

No. A wire transfer requires access to your online banking or a visit to a branch in person. An IBAN alone cannot initiate a transfer. What a scammer can do is set up a direct debit to pull money from your account, which is different and slower to process.

How long do I have to dispute a fraudulent direct debit?

You have eight weeks from the date the transaction posted to your account. After eight weeks, you lose the right to dispute under German banking law. Contact your bank as soon as you notice the fraud — do not wait.

Will my bank refund me while they investigate a fraudulent direct debit?

Yes. Your bank must reverse the transaction (put the money back) when ready when you dispute it. The investigation happens after, and if the scammer cannot prove they had a valid mandate, the refund is permanent.

Is it safe to give my IBAN to someone I met online?

Only if you have a legitimate reason to exchange money with them and you trust them. If someone you met once asks for your IBAN out of the blue, or if you are buying something and the seller asks for your IBAN instead of accepting a normal payment method, be cautious. Scammers use IBAN requests to set up fraudulent direct debits.

What should I do if I see a direct debit I do not recognise?

Contact your bank when ready and dispute it. Tell them you did not authorise it. Your bank will reverse the transaction and investigate. Keep any documentation you have — emails, messages, anything that shows you did not agree to the debit. This helps your bank's investigation.