Redeeming is done through the website only; there is a redemption section where a transfer to the chosen bank account can be created.
Having bank details only allows us to put money in, not the other way around, and yes they are safe, our system is a one way only; publicly - details can be sent to us, there is no function to call them from the members portal (this is the reason they have to be entered every time).
Additionally, redemptions are linked to the account's mobile number, and mobile numbers can only be changed if you have the account credentials or by Octopus staff. This way only the owner of the mobile number can verify a redemption.
We do not offer PayPal as they would take a cut from every redemption. This goes against our goal of getting you the most money in your pocket. If they ever change the processing model, we'll consider adding PayPal as an option.