SEPA uses your IBAN (account number), and one can also enter this account number for payment, implicitly allowing the store to withdraw money from it...

You must be referring to SEPA Direct Debit, which would be very risky to use to siphon funds. There's an 8 week no-questions-asked refund policy, 13 months for unauthorized transactions, if the payment fails (eg due to insufficient balance), the payee is charged a non-refundable cancelation fee. [0] And that's all separate from any legal troubles for fraudulent charges. I don't know why Germans use PayPal over SEPA, but I'd be surprised if SEPA Direct Debit was the reason.

[0] https://www.europeanpaymentscouncil.eu/what-we-do/sepa-direc...

IBANs aren't secret, they have the same level of confidentiality as your address or birth date.

One-off SEPA Direct Debit is virtually unheard of, recurring payments are a bit more common but usually involve a €0,01 payment to prove ownership of the account. The transactions are also trivial to undo, and can only be initiated by companies.

So no, "IBAN fraud" isn't a thing in practice. You can safely share your IBAN with your friends for instant free wire transfers.

Well yes. But just in case this wasn't clear: this is a crime, and you will get your money back in most cases. It's on the merchant to ensure a Direct Debit Mandate is actually valid.

I do not think it is possible to withdraw money having only an IBAN. It would need a SEPA direct debit mandate for my bank to accept the transfer request.

That sounds like the same info on a check, which people hand out freely. I'm probably misunderstanding.