They do. If I have someone's bank details I can transfer for free, instantly. (OK it sometimes takes a few minutes at weekends). There's two issues with ever using that for online payment:
1. There is no mechanism to obtain a refund for a mistake - eg I mistype the account number, someone else gets the money. Banks won't reverse but ask the payee to refund. If they still exist and are willing to cooperate. This is the route used for many, many scams like Microsoft calling because they noticed a fault with your Windows.
2. There is no protection under the Consumer Credit Act to obtain refund in the event the company goes bust or the product is defective and they won't refund. Credit cards have to provide that.
I use it with friends in preference to any other method, especially Paypal though.
Sofort are problematic because they a) access your account via credentials that it's against bank ToS to share and b) they scrape and store (and likely sell) transaction data unrelated to the current transaction because they have access to your account.
Credit cards definitely have check digits, pretty sure bank accounts don't, though I'm not certain.
Common enough that there's been a fair bit in the media[0] regularly, ever since instant transfers took off, and warnings from the Financial Ombudsman[1].
There's also been stories of people randomly discovering a few thousand appearing in their account and stupidly going out to spend it that day.
Maybe internationally, but usually domestically within the country IBANs aren't used, at least in Australia, UK, and United States. Hell, my bank here in the UK doesn't even give me an IBAN.
With SEPA I've been required to use the IBAN even for transfers within Germany. Which isn't all that different, as you only need to remember the two check digits and the order in which the old numbers appear within the IBAN. The UK and other countries that continue to use their own currency are a bit special regarding domestic payments, though:
SEPA does not cover payments in other currencies than the euro. This means that domestic payments in SEPA countries not using euro will continue to use local schemes, but cross border payments will use SEPA and euro against eurozone countries.
But you wouldn't see such a distinction in countries that use the Euro.
You can use IBAN domestically in the SEPA area for EUR account numbers. The banks usually allow the use of bank account numbers too and they then translate them to IBAN, so you don't have to.
What's more, account numbers in some countries themselves contain check digits.
1. There is no mechanism to obtain a refund for a mistake - eg I mistype the account number, someone else gets the money. Banks won't reverse but ask the payee to refund. If they still exist and are willing to cooperate. This is the route used for many, many scams like Microsoft calling because they noticed a fault with your Windows.
2. There is no protection under the Consumer Credit Act to obtain refund in the event the company goes bust or the product is defective and they won't refund. Credit cards have to provide that.
I use it with friends in preference to any other method, especially Paypal though.