I am not sure how much information they get from your account. Could be just the balance and transaction confirmation. Also, you need a separate transaction authorization. The log-in information is not enough to initiate a transaction.
Luckily for the German merchant, they also provided an IBAN I could copy-paste into the transfer form.