SEPA direct debit is the usual setup for places where you'd expect to be able to pay via credit card (regardless of fees), and for e.g. small landlords you just set up a recurring SEPA push transfer (basically like ACH push, but free for normal consumer accounts) to the landlords account.
And for direct debit, you can technically just keep an eye out for unauthorized ones (they need to be shown to your bank 5 days in advance) and tell your bank to stop them before they debit your account.
But AFAIK it's the bank(s) that owe you the money, though they can in-turn try to claw it back from whoever debited your account without authorization.
Really, the worst one can do with an IBAN is trolling by spamming transfers to it or signing it up for direct debits (and I'd expect that to cause me at most 1 bank day of no funds, while waiting for my bank to reverse a fraudulent debit).
But the impact of the latter is limited (just set up a whitelist with your bank and have them auto-reject the spam), while the former is fairly costly (around 20~30 ct with the accounts that don't do fair-use throttling) and quite risky (harassment and KYC).
SEPA direct debit is the usual setup for places where you'd expect to be able to pay via credit card (regardless of fees), and for e.g. small landlords you just set up a recurring SEPA push transfer (basically like ACH push, but free for normal consumer accounts) to the landlords account.
And for direct debit, you can technically just keep an eye out for unauthorized ones (they need to be shown to your bank 5 days in advance) and tell your bank to stop them before they debit your account. But AFAIK it's the bank(s) that owe you the money, though they can in-turn try to claw it back from whoever debited your account without authorization.
Really, the worst one can do with an IBAN is trolling by spamming transfers to it or signing it up for direct debits (and I'd expect that to cause me at most 1 bank day of no funds, while waiting for my bank to reverse a fraudulent debit). But the impact of the latter is limited (just set up a whitelist with your bank and have them auto-reject the spam), while the former is fairly costly (around 20~30 ct with the accounts that don't do fair-use throttling) and quite risky (harassment and KYC).