If you don’t get the money you’ll call up Citibank again to complain and they’ll take the hit to their operational losses budget [0], which happens infrequently as a percentage of transactions but quite frequently over the totality of the system. That’s what the budget is for.

[0] Contingent on the transaction going through and not being reversible, which can happen for many reasons (staleness by the time you report it, disinclination of someone who enjoys Monopoly to repay Bank Error In Your Favor, CS staff not having a button that reverses the transaction, Citi’s ops team [1] considering it beneath their notice, etc.)

[1] I oddly enough know the name of their SVP in charge of this team because Citi escheated a check due to me to the state of Illinois back in 200X. Illinois told me they had insufficient information to determine that I’m the same Patrick McKenzie so they want said SVP to file a report on my behalf. I assess 80%+ likelihood that they’ll comply. This is boring inside baseball mostly meant to underline the fact that BigBank actually does have people with names and addresses who deal individually with transactions according to some fairly involved business processes.

Tbh there isn't much security in SEPA either. The only reason SEPA Debit Fraud is rare is because A) it requires you having a bank account with a verified address and business registration and B) the bank is liable if the vendor goes fraudstering. The bank gets the money from the fraudster or they loose it.

You can also easily block or reverse transfers either in general or for specific merchants including down to blocking only weekly payments under 50€ from vendor X if you want to be really specific.

Secure enough to process $50 trillion in 2018.