Transit companies are pretty bad at PKI infrastructure and internet security combined with the inefficiencies inherent in German bureaucracy / anti-centralization as well as the inherent insecurity of the SEPA model sometimes make crime possible