mTan and smsTan can successfully fend off phishing attacks, but is this security enough?
Almost everyone has received a seriously looking email from PayPal, the post office or their own bank asking them to verify certain details. Lately, the argument most often used is some kind of security vulnerability, so that you have to check twice to find out if you really need to act now. Practically always, however, it is a phishing attempt, where the sender is a criminal who wants to steal the access data this way. In banks, the classic attempt is to empty the account, either via direct debit or transfer, or quite classically by direct debit. In the postal service, the most common example is the attempt to empty the account, either via TAN and direct debit or quite classically by direct debit. In the postal service, the most common example is the attempt to empty the account, either via TAN and direct debit or quite classically by direct debit. Pack station in the foreground, to be able to pick up the goods ordered with false data without any interference from the invoice.
Just as banks nowadays almost always send the TAN via SMS when transferring money, the postal service is now also using the SMS Tan method. Instead of entering the PIN at the packing station, SMS with a unique PIN code is now sent for pickup. The recipient of a shipment must therefore also have the mobile phone registered with the postal service, which normally only the actual recipient should have.
The smsTan method therefore offers quite good protection, but it should be noted that it only forces scammers to react. As recently shown by a Trojan called Tatanga Reports say that this Trojan simply accesses the user’s computer and uses the information entered by the user to make fraudulent transfers. This Trojan is still easy to detect, but as always, continuous improvement is expected. As a user, despite the benefits, you should not have complete trust in mTans. The weak point is always the human factor, so please carefully check where you are entering your mobile phone number; is it really your bank? At least this problem should not exist at the pickup station, especially if you are standing right in front of it.
However, another vulnerability remains: the mobile phone. Rather, the smartphone. Phishing apps on the phone can cause the smsTan to be intercepted in the background, so that you don’t even notice the transmission at all. Smartphones and apps make this possible. Banks are using it to their advantage. Terms and Conditions Then banning the simultaneous use of mTan and the banking app is logical, but of course it is utter nonsense. Many will not comply with this stipulation, and in the end it only serves to protect the bank's liability.
In conclusion: m-Tan or sms-Tan helps to increase security, but unfortunately, a one-hundred-percent protection has unfortunately not been achieved through SMS.