Account Security

March 01, 2010

One of the many responsibilities that Sibylle has shouldered in the wake of her mother's death has been managing the financial portion of the estate. Working with the local bank and the account manager there, Sibylle was able to figure out what automatic payments occur each month, and general was able to get a sense for what upcoming payments would need to be authorized.

We were able to establish online access to one account which will allow us to do some banking from here in the States rather than relying on phone calls, email or the postal service. The account security has a slightly different approach than any bank I've worked with here in the States. In addition to an account username and password there is a transaction number.

The bank mailed to our postal address a sheet with 100 6-digit numbers. Any transaction we want to perform online, transferring funds, making payments, et cetera, will require one of those numbers. During the process the bank's system asks for a specific 6-digit number, say #38. As the account holder you are expected to have access to the "TAN" sheet and therefore can lookup the corresponding TAN value and enter it upon request. Each number is only used once; in fact the sheet has room for the date the number was used and the purpose. The bank keeps track of how many transactions, and therefore how many TAN numbers have been used. When you have used 80 of the 100 a new sheet is automatically sent to you. And you have to activate that sheet using one of the remaining TAN numbers from the previous sheet.

In effect this is a one-time pad form of encryption. As long as we are the only people with our set of 100 6-digit numbers, no one else can do anything with our account even if they were to somehow discover the username and password. While it seems lower-tech at first than images and other confirmations that American financial institutions use to protect your account, I think it is less susceptible to fraud and attack. You'd have to break into our house and find the TAN sheet before you could do anything to that account.

One of the things I appreciate about traveling to other countries is seeing how they address and handle situations differently. The use of a TAN sheet with online banking is a much better solution, I think, than what we have here in the States.

Author's profile picture

Mark H. Nichols

I am a husband, cellist, code prole, nerd, technologist, and all around good guy living and working in fly-over country. You should follow me on Twitter.