[paduc]

> IBAN is public facing and it is not a problem to share.

I would be careful. In practice, you can setup a SEPA collection with an IBAN without the owner even knowing or signing a mandate because the banks don't check.

Of course, you can revert the transactions made this way, ... if you notice them (you have 30 days).

Edit: add time period