PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA TAN, or Transaction Authentication Number, is a one-time code that some banks use to help approve an online payment or another sensitive action. It is one part of an authentication process—not proof by itself that a transaction is safe. Banks may send or generate TANs in different ways, so follow your bank’s instructions and check the transaction details before approving.
What does TAN mean?
In online banking, TAN stands for Transaction Authentication Number. It refers to a code used to authenticate a transaction or other action. BaFin, Germany’s financial regulator, refers to online banking procedures using SMS-TAN and a TAN generator, while EU rules describe authentication codes used in covered strong customer authentication processes. These examples do not mean every bank uses the term TAN for every one-time code or uses the same method.
As an Amazon Associate I earn from qualifying purchases.
A TAN is generally intended for one-time use. Under the EU rules for the authentication process they cover, an authentication code must be accepted only once by the payment service provider. Commission Delegated Regulation (EU) 2018/389, Article 4 sets out that requirement.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What is a TAN used for?
A bank may ask you to enter or approve a TAN as part of authorizing an online payment or another sensitive action. The code helps the bank authenticate the action; it is not the entire security system. A one-time code also does not guarantee that a payment is legitimate or that an account is safe.
#1 Best Overall
How a TAN fits into authentication
Strong customer authentication is a process that uses at least two elements from different categories: something the customer knows, something the customer possesses, or something the customer is. Austria’s Financial Market Authority gives a phone that receives a TAN as an example of the possession category. The code or the device involved may therefore contribute to authentication without, by itself, satisfying every factor required by a particular process. The FMA’s explanation of strong customer authentication describes these factor categories.
How banks deliver or generate TANs
Methods vary by bank. Examples include an SMS-TAN sent to a phone and a code produced using a bank’s TAN generator. BaFin mentions both types of procedure in its guidance on payment services. BaFin’s guidance does not establish that a particular generator works across banks; use only the method your own bank supports.
Check the payment details before approving
In the EU’s transaction-specific authentication rules, the payer must be made aware of the amount and payee; the authentication code must be specific to those details, and changing either must invalidate the code. Those requirements apply within the regulation’s scope, not as a universal rule for every bank worldwide. The relevant provisions appear in Article 5 of Commission Delegated Regulation (EU) 2018/389.
- Read the amount and recipient shown by your bank before approving.
- If a request is unexpected or the details do not match what you intended, stop and verify it through the bank’s app or website opened directly, or through a known official contact method.
- Never share a TAN with someone who contacts you unexpectedly.
U.S. interagency guidance notes that authentication methods have different strengths and vulnerabilities, including the risk that a one-time code can be intercepted. It also recommends helping customers recognize legitimate communications, particularly messages seeking information that could provide access to an account. See the Federal Reserve-hosted interagency guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Rules depend on where the payment is made
European Union
Commission Delegated Regulation (EU) 2018/389 sets technical requirements for strong customer authentication and authentication codes within its scope. The linked EUR-Lex text is the consolidated version dated September 12, 2023, and is marked in force. Its requirements should not be treated as rules for every country or every banking service.
India
The Reserve Bank of India’s Authentication mechanisms for digital payment transactions Directions, 2025, dated September 25, 2025, apply to covered domestic digital payment transactions. They require at least two distinct authentication factors unless an exemption applies, with at least one factor dynamically created or proven for transactions other than card-present transactions. Payment-system providers and participants must comply by April 1, 2026. These directions have a defined Indian scope; they are not a global standard. Read the RBI’s 2025 directions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
