I know they use geo checks, and they’ll have some smarts in there.
Biggest thing Monzo has is instant notification… If someone does somehow get hold of your details then you’ll know quickly and can block the card in the app and start the refund process. This is already better than other banks where you may not know for days by which time the fraudster has made dozens of transactions.
A fraudulent Direct Debit would be covered by the same rules every bank runs under - those would be rare anyway as companies don’t want to lose their right to use them, so they’re careful.