Actually, the Volksbanks wanted to have already abolished SMS-TAN: But because some customers still need to change over, the deadline is now the end of September.
The Volksbanken and Raiffeisenbanken want to discontinue SMS-TAN as a legitimation procedure for online banking on September 30th. The cooperative IT service provider Atruvia explained this to voonze online. Actually, the shutdown plans that became known in February should have been implemented earlier. However, there were customers who were still dependent on SMS-TAN. “In order to give banks more time to convert these customers, the shutdown has been postponed to the end of September,” Atruvia said.
The goal is to direct SMS TAN users to the newly introduced TAN app VR Securego plus. According to Atruvia, the “special constellations” that cause delays include customers with Huawei devices, customers with rooted smartphones and certain corporate customers. With the Huawei devices, the lack of Google services is the obstacle: However, work is being done to make the app available in Huawei’s app gallery soon.
On the other hand, VR Securego plus could refuse the service on rooted smartphones. Whether that will change or whether customers can hide the root status with tools such as Magisk or then have to switch to other methods such as a TAN generator and giro card – Atruvia has yet to answer this.
Shutdown due to safety concerns
Overall, however, the change is already well advanced. VR Securego plus already has 3.6 million users. 600,000 customers of Volksbanks and Raiffeisenbanks still use the mobile TAN, but many of them are inactive. At the end of 2021, the number of users was still 1.7 million. 2.7 million users were still using the older TAN app VR Securego. This is also to be switched off in the future and users are to be transferred to the newer Plus version. However, there is not yet a switch-off date for Securego.
In February, Atruvia cited security concerns as one of the reasons for the end of SMS-TAN. In theory, text messages could be intercepted or tapped too easily on stolen mobile phones.
Savings banks also need it
The savings banks are also behind schedule with the SMS TAN deactivation. Actually, this should be over by the middle of this year. German Savings Banks and Giro Association (DSGV) declared now to the Handelsblatt, the step should be taken this year. When exactly individual savings banks switch off the procedure is up to them. Overall, SMS-TAN is only used by less than 20 out of 360 savings banks. The number of users has shrunk from 800,000 at the beginning of the year to 200,000 in June. Here, too, one wants to redirect to other methods such as photo TAN or app-based TANs from the S-Push-Tan app.
SMS-TAN is a two-factor authentication method. The bank sends a transaction number (TAN) to a mobile phone known to it; the number must then be entered in online banking for authentication for a specific transaction. The Federal Office for Information Security (BSI) has been advising for a long time not to use the SMS TAN procedure. Numerous financial institutions have already buried the procedure. But banks such as Deutsche Bank or Commerzbank still offer it.
