Rule of thumb.
Never ever set up or approve direct debiting to any of your accounts or any periodical payments no matter how 'reputable' the recipient is.
Murphy always wins and it costs far more to undo the damage than to pay as you 'buy'.
Your eager to please lending institution, will approve debiting your account as the precedent already exists and when you try to get your cash back, how did the 'merchant' get your account details if you didn't disclose them.