Well, given that they have all the login information (bank, user/account number, password/pin) they can basically access everything that is read-only and not TA

Well, given that they have all the login information (bank, user/account number, password/pin) they can basically access everything that is read-only and not TAN protected. For my bank the transfers of the last month would be accessible right away, for example. Honestly, I (German as well) didn't believe 1ris right of the bat and went to their website to prove someone wrong on the internet. Oh my was I wrong (apologies, 1ris). Horrible idea.