An IBAN can be used to take money via SEPA direct debit.
Perhaps other banks don't do this and that is the problem.
Basically you do this with your bank and not the other way around with the merchant.
Is it common to check all your banking stuff every month to make sure there is nothing fraudulent? I don't see how this is practical