You must be referring to SEPA Direct Debit, which would be very risky to use to siphon funds. There's an 8 week no-questions-asked refund policy, 13 months for unauthorized transactions, if the payment fails (eg due to insufficient balance), the payee is charged a non-refundable cancelation fee. [0] And that's all separate from any legal troubles for fraudulent charges. I don't know why Germans use PayPal over SEPA, but I'd be surprised if SEPA Direct Debit was the reason.

[0] https://www.europeanpaymentscouncil.eu/what-we-do/sepa-direc...

IBANs aren't secret, they have the same level of confidentiality as your address or birth date.

One-off SEPA Direct Debit is virtually unheard of, recurring payments are a bit more common but usually involve a €0,01 payment to prove ownership of the account. The transactions are also trivial to undo, and can only be initiated by companies.

So no, "IBAN fraud" isn't a thing in practice. You can safely share your IBAN with your friends for instant free wire transfers.

Well yes. But just in case this wasn't clear: this is a crime, and you will get your money back in most cases. It's on the merchant to ensure a Direct Debit Mandate is actually valid.

I do not think it is possible to withdraw money having only an IBAN. It would need a SEPA direct debit mandate for my bank to accept the transfer request.

That sounds like the same info on a check, which people hand out freely. I'm probably misunderstanding.