Unfortunately iTAN's are no more. iTAN is solid secure concept, if you take normal post service for granted, handle the paper with care, and don't fall for "ph

Unfortunately iTAN's are no more. iTAN is solid secure concept, if you take normal post service for granted, handle the paper with care, and don't fall for "phishing attacks" where the attacker tricks the user into logging into a forged copy of the bank's website. From a security point of view (imho, please correct me) is iTAN more secure than SMS-token (mTAN), email-token and app-token. You simply cannot beat analog offline security, as the iTAN-list exists only in two places on the server and printed out on paper (user). https://en.wikipedia.org/wiki/Transaction_authentication_number#Indexed_TAN https://en.wikipedia.org/wiki/Transaction_authentication_num... iTAN (Indexed_TAN) article: "Indexed TANs reduce the risk of phishing. To authorize a transaction, the user is not asked to use an arbitrary TAN from the list but to enter a specific TAN as identified by a sequence number (index). As the index is randomly chosen by the bank, an arbitrary TAN acquired by an attacker is usually worthless. However, iTANs are still susceptible to man-in-the-middle attacks, including phishing attacks where the attacker tricks the user into logging into a forged copy of the bank's website and man-in-the-browser attacks which allow the attacker to secretly swap the transaction details in the background of the PC as well as to conceal the actual transactions carried out by the attacker in the online account overview. Therefore, in 2012 the European Union Agency for Network and Information Security advised all banks to consider the PC systems of their users being infected by malware by default and use security processes where the user can cross-check the transaction data against manipulations like for example (provided the security of the mobile phone holds up) mTAN or smartcard readers with an own screen including the transaction data into the TAN generation process while displaying it beforehand to the user (chipTAN)."