Homebanking via HBCI / FinTS 3.0 - safety first

HBCI (Home Banking Computer Interface), now known as FinTS (Financial Transaction Services) 3.0, is an established and widely used standard in Germany for secure communication between bank customers and their financial institutions. It forms the technical basis for the highest level of security in electronic payments and online banking. Through its standardized interface, FinTS 3.0 enables the use of various banking software to manage accounts comfortably and securely, make transfers, or set up standing orders.

The motto “safety first” is comprehensively fulfilled by the advanced architecture of FinTS 3.0. The standard relies on end-to-end encryption, ensuring that all sensitive data is protected from unauthorized access during transmission between the customer’s computer and the bank server. Additionally, digital signatures are used, which guarantee both the authenticity of the transaction partners and the integrity of the transmitted data throughout its entire journey.

These robust security mechanisms make FinTS 3.0 a preferred choice for businesses and individuals who demand the highest security standards for their home banking. The standard is continuously developed and supported by the German banking industry to proactively address future security challenges and ensure a trustworthy environment for financial transactions.

HBCI with Chip Card

The implementation of HBCI/FinTS 3.0 using a chip card represents one of the safest variants for online banking. In this method, the cryptographic keys required for digital signatures and data encryption are not stored on the user’s computer but on a tamper-proof chip of a special bank card. This significantly increases security, as the critical keys never leave the protected environment of the chip card.

The use of a chip card effectively protects against a variety of cyber threats. Since the signature processes take place directly on the chip of the card, it is nearly impossible to capture private keys through malware or phishing attacks. Even if a computer is infected with malicious software, the keys necessary for authorizing transactions remain untouched on the physically secured card.

To use HBCI with a chip card, only a compatible chip card reader is required, which is connected to the computer. This reader acts as a secure interface between the chip card and the banking software, allowing the user to conduct their financial transactions in a highly secure environment that intelligently combines physical and cryptographic security.

HBCI with PIN and TAN

The security of the HBCI procedure with a chip card is further enhanced by the combination of a personal identification number (PIN) and a transaction number (TAN). The PIN serves as the first security factor to activate the keys stored on the chip card and authorize the use of the card. Only after the correct entry of the PIN is access to the functions of the chip card unlocked, providing effective protection against unauthorized use in case of loss or theft of the card.

After successful PIN entry, an individual TAN is generated for each transaction. The special feature of HBCI with a chip card is that this TAN is generated directly on the chip card itself, based on the specific transaction data (e.g., recipient, amount). This principle, often referred to as “What You See Is What You Sign” (WYSYWYS), ensures that the displayed transaction data exactly corresponds to what is confirmed by the TAN. Manipulation of the transfer data afterward is thus practically excluded.

This methodological connection of the PIN for card unlocking and a transaction-bound TAN generation on the chip card offers an extremely high level of security. It eliminates vulnerabilities that may occur with other TAN procedures, such as the susceptibility of SMS-TANs to SIM swapping or the risks of TAN lists. With HBCI via PIN and TAN on the chip card, users benefit from the highest level of control and security over their financial transactions.