Hacker News Reader

I thought in Germany you used one-time disposable TAN numbers for this purpose?

Australia also has direct person-to-person/business money transfers, but without the one-time-use pins. That this company would even ask for a bank login is terrible and unnecessary.

View on HN

> I thought in Germany you used one-time disposable TAN numbers for this purpose?

We do, Sofortüberweisung just acts as a man in the middle and passes through all TAN requests from the banking website to the client. They can't transfer money out of your account without your consent, but they can do just about anything else that doesn't require a TAN.

If someone intercepts the traffic (a hack on sofort's server) they could read all transactions and account info without anyone noticing. Guess with that information you could make a lot of money phishing.

Reply on news.ycombinator.com