That sounds rather unacceptable.

Yes, I don't think anyone truly wants it to be like this. But it's just what happens.

You of course cannot access and empty out someone's bank account this way, you're safe in that regard. But you need to dispute the invoices as soon as possible to show that it is fradulent, so you don't end up needing to actually pay for it. Or get debt collectors after you.

It basically never happens. I don't know where the GP got their story from.