Yes, I don't think anyone truly wants it to be like this. But it's just what happens.

You of course cannot access and empty out someone's bank account this way, you're safe in that regard. But you need to dispute the invoices as soon as possible to show that it is fradulent, so you don't end up needing to actually pay for it. Or get debt collectors after you.

^ Never had this happen in my 30 years here so YMMW

So don't take this poster by their word.

Not saying it DOES NOT happen as it is a system not made for the internet. But widespread? It is not.