No one can drain ky bank account through my payment card either. For one, they lack the authorisation to do so, and for another, there's a limit (which I can change) to how much can be transferred per day.
Outside of the US, the banks do tell the criminals - otherwise the banks would be the hook. This is the fundamental difference between the US and the RoW: in the US, fraudulent withdrawals are the depositors problem[1] which banks don't expend too much effort into, elsewhere, it's the banks' problem, consequently banks go the extra mile to prevent fraudulent withdrawals, and when it does happen, are quick to make the depositor whole.
1. This and "identity theft" are emblematic of a mostly American tendency to pass the buck (and losses) to the least powerful and least informed entity (the depositor) for fraud committed against financial institutions using depositor's information.
I think they already know, because their efforts are mostly focused on trying to get that authorization. But whether you know about it or not, no authorization means you can't access the money. Requiring explicit authorization is key to security, and I'm extremely wary of payment systems that don't require it, like credit cards.
2FA, you get a popup in your bank app asking "Do you want to pay X euro to Y?" for online payments. Can turn that off if you want, but it isn't a big bother.
That‘s not how direct debit works. There is no accountholder involvement with processing direct debits, but they can be easily reversed (although after the fact).
There are related payment schemes though that do initiate a push payment (i.e. SEPA credit transfer), giving the accountholder control over the amount and payee, but they are not yet as ubiquitous or usable internationally.
That is exactly how my debit card transactions works. When I buy a game on steam using my debit card I get a popup in my phone asking if I really initiated the payment and lets me decline.
The payment page spins until I click ok on it in the phone, since my bank wont accept the transaction otherwise.
The grandparent post was asking about the German payment system, which presumably refers to SEPA Direct Debit, not debit cards.
What you are referring to is called 3DS, and it's a feature of both credit and debit cards. (It's available worldwide, but most commonly used in the EU, since it's mandated for ecommerce card transactions in many circumstances.)
I don't know how it works in Germany, but in the Dutch system, iDeal, I see the amount I'm authorizing. Of course if I'm sloppy and rapidly clicking through my bank's screens, I might not notice it if they changed the amount at the last moment, but any merchant that can be shown to do that would probably be in a heap of trouble.
I do think it's possible to authorize an unspecified amount; automated gas pumps seem to do that, but they seem to be the only ones, and it probably has a hard maximum.
Of course any PIN transaction that goes through the merchant's equipment is not quite as secure and relies on a level of trust that's not necessary for online payments, where I give my authorization through my own bank's website.
In the Netherlands the customer picks theirs from a list of banks on the iDEAL website then the transaction is done on their banks website. Other services can be fit in front to extend the choices with other payment processors.
If they do that (via direct debit), I can click a button in my online banking interface, immediately get the money credited back, and the merchant is debited that amount plus a fee.
