A direct debit can be set up without a signature.
Instead of a pen and paper physical signature mandate, banks and merchants often use "Paperless Direct Debits".
The authorization for the direct debit without a signature is granted through electronic consent, like agreeing to terms online, providing an electronic signature or even completing a verbal script over the phone.
So while, you don't need or require a physical signature for the direct debit to be set up, you also must still provide your account numbers and routing numbers along with explicit consent.
The specific rules for these direct debit authorizations also depend on your location as well as the payment network.
In the United States, under the NACHA (National Automated Clearing House Association) rules, authorizations for ACH debits can be written, signed, or "similarly authenticated." Electronic methods like checking an "I agree" box online, using a digital signature tool, or providing a recorded verbal agreement over the phone are all legally recognized methods of authorization.
UK / SEPA Regions: Systems like Bacs and SEPA utilize official Paperless Direct Debit (PDD) systems. During internet checkout, customers enter their details into an approved electronic mandate form which registers as a valid authorization without a wet signature.
And so because your physical signature isn't required to initiate a pull on your account, ensuring your bank account details are only shared with trusted merchants is also critical.
If you ever happen to notice an unauthorized direct debit, you are protected by banking regulations (such as the Electronic Fund Transfer Act in the US or the Direct Debit Guarantee in the UK), which allow you to dispute and reverse unauthorized payments.