> those transactions and their payloads are not cryptographically signed and neither are they verified anyhow [1] [2] Your linked sources [1] and [2] don't rea

> those transactions and their payloads are not cryptographically signed and neither are they verified anyhow [1] [2] Your linked sources [1] and [2] don't really cover that topic. They mainly cover the use of Android apps and highlight the danger that the Android devices might be hacked, recommending use of dedicated devices. From [2]: > Last but not least, please note that the photoTAN procedure is not only available as a smartphone app but also as dedicated hardware (Cronto, 2011). Naturally, our statements about the security features of app-based authentication cannot be transferred to thephotoTAN hardware device. Quite the contrary, a dedicated photoTAN device — available for all three analyzed banks — offers excellent security properties largely similar to those of chipTAN. But this wasn't your point. It might very well be that the transaction data is not verified by the generator devices and only displayed, but your sources don't state it.