Copycat login pages that steal your TAN

When you tap a link from a phishing message, it can open a near-perfect copy of your Sparkasse login. You type your details — and on the other side, the criminal enters them into the *real* bank and starts a transfer. The fake page then asks you to "confirm" with the pushTAN or photoTAN that just arrived, which actually approves *their* payment.

This is why an unexpected TAN is so dangerous. The TAN message itself always says what it is authorising — so read it.

What to do: never log in through a link. Use a bookmark you made yourself or the official app. If a TAN describes a transfer you didn't start, stop — don't approve it.