[laurencerowe]

In the UK direct debits don't require 2FA (but do require approved forms either online or on paper) but you can also very easily get a refund for any direct debit taken from your account so I assume it's simply not worth the scammers' time.

[foldr]

It's probably somewhat worth it because some people will never notice the debit.