[Luc]

> There is no validation except some nummerical tests. You can enter the number of some charity or your landlord when doing an order at e.g. Amazon.

That is... simply not true. Or perhaps I am misunderstanding what you are saying. There isn't a bank in the EU that will allow you to make a transfer from an account that's not yours (authenticated by whatever means - card readers, digipass, RSA keychain gadgets that display a new number sequence every minute, etc.).

[rmoriz]

direct debit ("Lastschrift") is kind of a reverse transaction. You tell your $own bank to collect the money from an account of your customer at $other bank

[Luc]

Oh right, I see, my mistake. I didn't know Amazon used this. In Belgium it's only used (afaik) by 'trusted' institutions, like utility companies. And as a customer you still need to authorize them the first time.