This resembles the most common way of authentication for online banking in Germany (a PIN and a list of transaction codes, so-called TANs). Do you always have

This resembles the most common way of authentication for online banking in Germany (a PIN and a list of transaction codes, so-called TANs). Do you always have to pick the next one-time code in the printed sequence? In Germany, you used to be free to pick any of the unused TANs, which made phishing really simple. Nowadays it's more common for a bank to challenge you to a randomly chosen TAN.