Yeah they for sure can. They just don't tend to bother I think. Hijacking an account and the payment method used to pay on that account to go with it is a lot of work to do something you can do with less work.

May be business dependent tho. I guess selling source code means the people interested in defrauding you are fairly tech savvy too.

And yes, really liked it :)

If you are using direct debits you have no way of pulling the money directly from the account - you will always have some serious lag (day or two at least, often more). In that time you don't have a hold or similar on the funds, so either you delay giving product to customer or you have a few days where you trust him to actually have the funds available when your claim hits his bank. If he doesn't actually have funds at that time you effectively have a chargeback (no funds were actually available to take in the first place). Usually these are honest mistakes, especially if you do recurring billing that the customer may forget, but it's costly and time consuming to explain what happened and have the customers pay you again for something they actually want.