> In most other countries, the worst you can do is deposit money.

So in the EU, anyone can indeed pull money with your account number (and with RTP that may change someday). But we can also revoke any such direct debit within a certain period of time.

I had to do it once, over my banking app, money was back the moment after I clicked.