On: FTX stored private keys to crypto assets in plaint...

[lxgr]

> By default, those requests are denied.

That's not the case in Germany, at least.

[RandomLensman → lxgr]

Banks don't need a SEPA mandate to allow a direct debit?

[germanier → RandomLensman]

The SEPA mandate is between the parties in the transaction. While banks require their existence, it is usually not shared with the banks involved.

[RandomLensman → germanier]

So only a creditor ID is needed if someone has a set of IBANs and then things will be processed?

[germanier → RandomLensman]

A creditor ID and a direct debit agreement with some bank, yes. After you have those, (usually) the banks won't verify individual transactions.

[oblio → lxgr]

Do you mean that if I know a German bank account number I can just withdraw money for me?

Be right back, asking some German friends for their bank account numbers.

Jokes aside, you're probably wrong. There's NO way I can just pull money from their bank account just by knowing their bank account number.

[lozenge → oblio]

As a person you can only send them money. As a business you can initiate a direct debit which withdraws money. However you are attesting that they signed a direct debit agreement with you and provided their account number and agreed on the amount to pay.

This is the same as a credit card - you can charge any card with just the number and a couple of basic details, however if there's a complaint "I found these CC details on a random website" isn't accepted, you need to show the card holder agreed to the charge. If you don't provide the evidence the transaction is reversed.

[jeltz → lozenge]

That is usually not how credit cards work anymore. Sure, you can try to charge any card but if it is issued by a European bank it will very likely be denied and you will be asked to do a Strong Customer Authentication.

Same applies to SEPA direct debit. Here in Sweden most (all?) banks requires the customer to sign digitally before any direct debit mandate is created.

[oblio → lozenge]

That's a distinction without a difference.

I obviously don't care about people sending me money, I care about people requesting money from me.

Individuals can't do it and business can only <<ask>> for money, that's different.

[germanier → oblio]

Yes, if you set up a direct debit agreement with a bank you can do that. If you'd actually try what you suggest it will be revoked quickly and charges filed as your identity is known.

[lxgr → oblio]

> Jokes aside, you're probably wrong.

What GP says is accurate.

> Do you mean that if I know a German bank account number I can just withdraw money for me?

You most likely can't, because if you have to ask this you don't have an agreement with a SEPA Direct Debit originating bank that lets you :)

And even if you decide to open one now: Given the risks involved for the originating bank, they will heavily scrutinize your business case and demand considerable collateral and/or payout time limits.

[summarity → oblio]

Yes, yes you can. Name + IBAN is all you need to enter even large recurring payments.

[oblio → summarity]

I don't believe that.

Let's say I have account number 1234 and my name is John Doe.

You're telling me that, no strings attached, no repercussion, Mike Hacker can set up a large recurring payment from my account, without my approval?

I'd need solid proof of how that would work.

[jon-wood → oblio]

Yes. That is a thing that can be done, here’s Stripe’s documentation on how to set up a Direct Debit mandate: https://stripe.com/docs/payments/payment-methods/bacs-debit?...

The thing that’s being missed here is that direct debits can be disputed in the same way a credit card payment can, and by default the customer wins. Their money will be refunded immediately by the bank, who will then go after you to get it back.

[jeltz → jon-wood]

Yes and no. Swedish banks for example will just deny direct debits unless the customer has explicitly agreed to let their accounts be charged. So direct debit works differently per country and per bank.

[oblio → jon-wood]

Ok, that's both interesting, slightly unsettling, but also doesn't really fall under:

> You're telling me that, no strings attached, no repercussion

This bit:

> by default the customer wins. Their money will be refunded immediately by the bank, who will then go after you to get it back.

sounds a lot to me like repercussions :-)

[lxgr → summarity]

Most importantly, you need a bank that will let you submit any DD requests.