Protecting your accounts: two-factor authentication, SIM swapping, phishing of broker logins and access arrangements for heirs
Harden your bank and broker logins against the attacks actually used against German investors, and arrange access so that your heirs can reach your assets without months of delay.
What you will learn
- Which second factors are strong, which are weak, and why SMS codes fail against SIM swapping.
- How broker-login phishing works today, including real-time relay and approval fatigue.
- Which built-in broker features (reference account, withdrawal locks, alerts) stop a thief even after a successful login.
- How to give heirs or a trusted person lawful access without handing over passwords today.
Explanation
Account takeover is the fraud that hits careful investors who never fall for a fake broker. The attacker does not need to persuade you to invest; he needs your login, your second factor and a way to move money out. Basic crypto-wallet hygiene was covered in the Bitcoin course (lesson btc08); this lesson is about bank and brokerage accounts and about what happens to them when you cannot act yourself.
Strong customer authentication and the three factor types
The EU Payment Services Directive 2 (PSD2) requires strong customer authentication (SCA) for online banking: two independent elements out of knowledge (password, PIN), possession (phone, hardware key, card) and inherence (fingerprint, face). Brokers apply the same model voluntarily or because they are banks. The security of the whole scheme equals the security of the weakest factor:
| Second factor | Main attack | Assessment |
|---|---|---|
| SMS code (mTAN) | SIM swapping, SS7 interception, phishing of the code | Weak; avoid where any alternative exists |
| Authenticator app (time-based one-time password, TOTP) | Real-time phishing relay of the 6-digit code | Medium; immune to SIM swap, not to a convincing fake login page |
| Bank push app (pushTAN, photoTAN) showing transaction details | Approval fatigue, malware on the same phone | Good if you read the amount and IBAN on screen before approving |
| Hardware key or passkey (FIDO2/WebAuthn) | Physical theft of the key | Strongest; the key only answers the genuine domain, so phishing pages get nothing |
SIM swapping
In a SIM swap the attacker convinces your mobile provider, by social engineering or with leaked personal data, to port your number to a new SIM or eSIM. From that moment all SMS codes and "forgot password" calls go to him. Warning sign: your phone suddenly shows "no service" for longer than a few minutes in an area with coverage. Defences: set a separate customer password (Kundenkennwort) with the provider for all changes, use an authenticator app or hardware key instead of SMS wherever your broker allows it, and never use the mobile number as a password-reset channel for your main e-mail account, because the e-mail account is the master key to everything else.
Phishing of broker logins
Modern phishing is no longer a misspelled e-mail. Typical patterns: a sponsored search result for your broker's name leading to a lookalike domain; an SMS "your account is restricted, verify within 24 hours"; a call from "the security department" asking you to approve a push notification "to cancel a suspicious transfer". Reverse-proxy kits relay your password and TOTP code to the real site in real time, so even an authenticator app can be defeated. Rules that hold: type the broker address yourself or use the app; never approve a push request you did not trigger at that moment; a bank or broker never asks for a TAN by phone; and if a page asks for a code "to cancel" something, it is a fraud, because cancellation never needs a transaction code.
Features that limit the damage after a login
German brokers typically allow withdrawals only to a reference account (Referenzkonto) in your own name; changing it requires a separate, strongly authenticated step and often a waiting period. Check that this is switched on, activate transaction and login alerts by e-mail and push, set a daily transfer limit on the linked bank account, and keep the e-mail account behind a hardware key or passkey. Review the list of connected devices and API keys quarterly and remove old ones.
Access for heirs and for emergencies
If you die or become incapacitated, your heirs do not automatically have access. Banks may require proof of succession, usually a certificate of inheritance (Erbschein) or a notarial will with the court's opening record; the Federal Court of Justice has ruled that a bank cannot insist on an Erbschein when a notarial will clearly proves the heir. A handwritten will alone is normally not accepted by banks as proof. Obtaining an Erbschein costs court fees that scale with the estate and takes weeks to months. In the meantime a securities account stays exposed to market risk and nobody can sell. The practical tools are:
- A bank power of attorney valid beyond death (Konto- und Depotvollmacht über den Tod hinaus) on the bank's own form, given to a trusted person. It gives immediate access without an Erbschein; the heirs can later revoke it.
- A Vorsorgevollmacht for incapacity and, separately, a notarial will if the estate is complex.
- An access document stored offline (sealed envelope, safe-deposit box, or a password manager with emergency access): list of institutions and account numbers, where the hardware keys are, and how to reach the e-mail account. Do not write passwords in the will, because the will becomes a court document.
- Know that German banks must report balances at the date of death to the tax office, so hiding accounts from heirs or from the Finanzamt is neither possible nor lawful; the point is speed, not secrecy. The BGH confirmed in 2018 that digital accounts pass to the heirs like any other contract.
Worked example
Hypothetical example: Petra, 58, keeps a Depot worth €250,000 and €40,000 Tagesgeld at one bank. Her logins use a password plus SMS codes to one mobile number; the same number is the recovery channel for her e-mail. Her adult son is her sole heir but has no power of attorney. Fees and taxes are ignored.
- Single point of failure: a successful SIM swap gives the attacker SMS codes and the e-mail recovery channel, so one attack covers all accounts. After switching the broker and e-mail to an authenticator app and a hardware key, a SIM swap alone yields nothing; the attacker must also physically obtain the key.
- Estate delay: assume the Erbschein takes six weeks and the market falls 3 % during that time. Exposure on the Depot: 3 % × €250,000 = €7,500 that nobody could act on, plus six weeks of living costs the son cannot draw from the €40,000.
- Cost comparison: assume court fees for the Erbschein of roughly €1,000 for an estate of this size (fees are set by the court fee schedule and rise with the estate; check the current table). A bank power of attorney beyond death costs €0 and gives access on day one. The Erbschein may still be needed later for other assets, but the time-critical access problem is solved.
Common mistake
Practice activity
On paper, draw an "access map" for a hypothetical household: one main e-mail account (recovery by SMS to phone A), a broker (password + SMS to phone A), a bank (password + pushTAN on phone A), a crypto exchange (password + TOTP on phone A). Phone A is stolen unlocked. For each account write whether the thief can log in and move money, and which single change would reduce the number of compromised accounts the most. Then list the three documents a trusted person would need to act on your behalf in case of sudden incapacity.
Show solution
Stolen unlocked phone A: e-mail is likely compromised via SMS recovery; the broker falls because SMS and e-mail are both available (password reset); the bank's pushTAN app is on the same phone, so if the app has no separate PIN or biometric lock, transfers can be approved; the exchange's TOTP app is also on the phone. In the worst case all four are compromised, and the single most effective change is moving the e-mail account to a passkey or hardware key with no SMS recovery, since the e-mail is the reset channel for everything else; second best is a separate PIN on the pushTAN and TOTP apps and automatic phone lock. Documents for incapacity: a Vorsorgevollmacht, a bank power of attorney (including the Depot) on the bank's form, and an offline access document naming institutions, account numbers and the location of hardware keys. Limitations: real phone security depends on lock settings and biometric protections; the exercise assumes an unlocked device.
Key takeaways
- SMS is the weakest second factor; authenticator apps resist SIM swap, hardware keys and passkeys also resist phishing.
- Never approve a push notification you did not trigger, and never give a code to "cancel" anything.
- Reference-account withdrawals, alerts and a protected e-mail account limit damage even after a stolen login.
- A bank power of attorney valid beyond death plus an offline access document gives heirs lawful, immediate access; an Erbschein alone costs time and money.
Next step
The final lesson of this course turns everything into two documents you can keep: a personal due-diligence checklist for any investment offer and a written fraud-response plan.
Self-check
Answer the questions, then check your answers. You can retry as often as you like.
Automatic self-check for your own revision. Your answers are checked in your browser and are not seen or assessed by us. It is not an exam and not a qualification.
Your progress
“Complete” only means you marked the lesson as done. It is not a test of your understanding. Progress and notes are saved only in this browser on this device — not in an account.