Direct debit and subscriptions

How to spot a subscription you never signed up for

A debit appears on your statement that you do not recognise, or a message says your subscription has “expired” and you have 48 hours to renew. Two situations, one core question: does a valid mandate exist, and if not, how do you get the money back? A direct debit is only valid if you gave written or online authorisation in advance; a mandate given over the phone does not count (Consumentenbond, Dutch consumer association, 27 January 2026).

The rule most people miss: you can reverse any direct debit yourself within eight weeks, with no reason required (ACM ConsuWijzer, reversing a direct debit).

Direct answer: five checks on a debit for a subscription you never signed up for

1. Read your own statement and look the name up. The name on the statement is often not the shop but a payment service provider or an unfamiliar trading name (Consumentenbond, unclear names on your statement). Search it: several reports of unjustified debits tell you what you are dealing with.
2. Reverse it yourself within eight weeks. You can do that in your banking app or through your bank, without giving a reason (ACM ConsuWijzer). The bank does not check whether the debit was justified; if you genuinely owe an invoice it still has to be paid, so use this for charges you do not recognise or dispute.
3. Older than eight weeks? Ask your bank to reverse the unjustified debit. An unjustified debit can be recovered through your bank for up to thirteen months; the collector must then prove a valid mandate, and if it cannot, the amount is returned (ACM ConsuWijzer).
4. Stop the debit and block the collector. Ask the collector and your bank to end it, and put the collector on your bank’s block or approval list, where you decide which companies may debit you (ACM ConsuWijzer). Do not let anyone “renew” or “cancel” anything through a link in a message.
5. Never cancel or pay through a link in a message. The Dutch Fraud Helpdesk publishes emails claiming your subscription has expired, with a 90% discount, a deadline and 48 hours of pressure to renew through a link (Fraudehelpdesk, sample email). Open the service yourself at the address you already knew and use your own cancellation route. Under the US FTC’s Click-to-Cancel rule, cancelling must be as easy as signing up: if you could sign up online, you cannot be forced to call (FTC, October 2024).

When someone opened it in your name

A subscription taken out in your name that you end up paying for is a criminal offence in the Netherlands, and it sometimes comes with coercion (politie.nl, subscription fraud). Do three things: contact the provider immediately to have the subscription or number blocked, always file a police report, and check whether anything else was opened in your name. When cancelling, never give a new mandate, and never pay a “handling” or “cancellation fee” link: a legitimate cancellation costs nothing.

What AI changes here

AI does not change the debit itself. It changes the message around it: flawless language, a convincing layout and a precise deadline now cost a fraudster almost nothing, while the real failures sit in the subscription that does not exist and the link that leads to a copied login page. That is why the decision belongs in your own statement, your own cancellation route and the mandate question put to the collector, not in the message.

What a detector does and does not see

You can run a statement, a collection email or a PDF “subscription overview” through the text detector or the document detector. That is triage: it helps you decide which message to verify first and gives you a note for your report. It says nothing about the collector, about whether a mandate exists, or about your right to a reversal. Short collection emails carry too little writing style for a reliable signal, so a low score never proves a debit is legitimate.

What the message cannot establish

• whether the sender is the collector, even when name and logo match;
• whether a valid mandate exists — only the collector and your bank can show that;
• whether the company exists and what it delivers; look the trading name up;
• whether it is fraud; your bank, and ultimately a court, establish that, not a message.

Treat the message as a prompt to check your own records, never as proof of an obligation.

If you already paid or entered details

• Reverse the debit or file an unjustified-debit report with your bank; a live mandate keeps collecting until you block it.
• Paid through a link, or entered card or login details? Call your bank the same day on a number you look up yourself; with a card payment you can also start a chargeback.
• Keep everything: the statement with the collector name, the mandate reference, the email with headers, the link and the timestamps.
• Report it to the fraud desk and file a police report if something was opened in your name or money has gone missing.

More on this family of messages is in the guides on a fake debt collection letter, checking a suspect invoice and a fake login page. To check a file or a piece of text on its own, use the free checker.

Frequently asked questions

Can I simply reverse a direct debit?

Within eight weeks you can reverse any direct debit without giving a reason. Note that a genuine outstanding invoice still has to be paid and reminders may follow. If the debit is unjustified, the bank route for an unjustified debit is the right one, available for up to thirteen months.

I never signed up. How do I prove that?

You do not have to: with an unjustified debit, the collector must produce a valid mandate. A mandate given over the phone is not valid; only written or online signed authorisation counts.

Does a high detector score prove a debit is unjustified?

No. The score describes patterns in text or a file and says nothing about the collector or a mandate. A low score does not prove the debit is justified either; the mandate question at the collector and your bank is the real check.