How exactly are they able to extract money from your account just from having account number and your name? Does this mean I can, too? (I assume you don't give them your password, and even then an outgoing transaction requires an OTP.)
It depends on what country you're in but in Germany this is possible. Businesses can just withdraw from your account. You can dispute this for a number of weeks though and can get it back. The business then needs to prove that you authorised them to withdraw the money.
