https://de.wikipedia.org/wiki/N26_(Direktbank)#Kritik
And in particular:
https://www.heise.de/newsticker/meldung/33C3-Schwere-Sicherh...
Banks in general are terrible at IT security here, but N26 seems to be the particularly special completely and utterly incompetent kind of terrible.