The german ChipTAN (https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_/_CardTAN) system calculates a TAN that is send to the banking server to proof the transaction. The number is usually 6-8 digits long. But how can this short number be secure?
In my opinion a secure TAN has to be calculated from the receivers bank account number, the transfer amount, the date/time and a secret that is only known by the bank and the user.
But how can this all be calculated into 8 digits? In my oppionion this is highly vulnerable to collision attacks. And I also think that the secret could be easily calculated if an attacker can catch multiple TANs. If an attacker could catch multiple TANs and also knows the algorithm he can find a key that can reproduce those TANs. And there is a high chance that this value may work for new TANs as well.
Is this system as vulnerable as described? Or do I misunderstand something?