The user has requested it. That's the issue. Or at least vodafone have been lead to believe they have.
Initially a user would approach their operator to get the ability to use such services enabled not a 3rd party approaching the operator. If someone makes use of my bank details without my permission the bank will investigate and return the funds, etc.