iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In online banking, TAN usually means Transaction Authentication Number: a one-time code a bank may ask you to enter or approve to authenticate a payment or another sensitive action. It is one part of the bank’s authentication process, not a guarantee that a transaction is safe. The method and instructions depend on your bank.
What does a TAN do?
A bank uses a TAN as an authentication code during an online banking procedure. Depending on the bank, it may be delivered by SMS or generated with a TAN generator. The German financial regulator BaFin lists both SMS-TAN and TAN-generator procedures in its guidance on payment services: BaFin’s guidance on the Payment Services Supervision Act.
The term does not mean that every bank uses the same code, delivery method, or procedure. Follow the instructions shown by your own bank, and do not assume that every one-time banking code is called a TAN.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How can a bank provide a TAN?
| Method | What it means | What to keep in mind |
|---|---|---|
| SMS-TAN | The bank sends the TAN by text message. | BaFin identifies SMS-TAN as an online banking procedure. Your bank determines how it works and when it is available. |
| TAN generator | A bank’s procedure uses a TAN generator to produce a code. | BaFin identifies TAN-generator procedures; compatibility and instructions depend on the bank. |
Is a TAN the same as strong customer authentication?
No. Strong customer authentication (SCA) is a broader process. It checks a customer using at least two elements from different categories: knowledge (something the customer knows), possession (something the customer has), and inherence (something the customer is). Austria’s Financial Market Authority gives a phone that receives a TAN as an example of a possession element: FMA information on strong customer authentication.
#1 Best Overall
A TAN, or the device or channel involved in receiving it, may contribute to authentication, but the code alone is not necessarily the whole SCA process. Requirements and implementations depend on the applicable rules and the bank’s procedure.
Why should you check the transaction before approving it?
A one-time code can still be exposed or misused. U.S. interagency supervisory guidance notes that authentication methods have different strengths and vulnerabilities, including the possibility that a one-time code may be intercepted. It also recommends helping customers recognize legitimate communications, particularly messages seeking information that could be used to access an account: Interagency guidance on authentication and access.
- Do not share a TAN with someone who contacts you unexpectedly.
- If a request seems unusual, open your bank’s app or website directly, or contact the bank through a known official channel.
- Before entering or approving a code, check the transaction details displayed by your bank, especially the amount and payee.
What do the rules say in the EU and India?
Authentication requirements are regional, not universal. The following examples describe specific rules and scopes rather than a single global standard.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
European Union
Commission Delegated Regulation (EU) 2018/389 sets technical requirements for SCA and authentication codes. The consolidated EUR-Lex text cited here is dated 2023-09-12 and is marked in force. In the covered SCA process, an authentication code must be accepted only once. For transaction-specific authentication under Article 5, the payer must be made aware of the amount and payee; the code must be specific to them, and a change to either invalidates it. Read the consolidated EU regulation for the full requirements.
India
The Reserve Bank of India’s Authentication mechanisms for digital payment transactions Directions, 2025, dated 2025-09-25, apply to covered domestic digital payment transactions. They require payment-system providers and participants to comply by 2026-04-01. For covered transactions, the Directions require at least two distinct authentication factors unless an exemption applies; for transactions other than card-present transactions, at least one factor must be dynamically created or proven. These conditions apply within the Directions’ stated Indian scope. See the RBI Directions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
