Postbank will deactivate two-factor authentication via SMS-TAN in August. You are henceforth to instead provide an authentication password, optionally unlockable via (unspecified) biometry. One password thus authenticates all transactions. Everything is much better and more secure.
Now of course, we may assume that the experts inventing this system are not complete idiots. So obviously there's something that I'm not understanding.
What exactly is the advantage of a password that is indefinitively stored in some form (hopefully hashed in some way) on the server and stored (hopefully encrypted, but necessarily decryptable) on an easily-stolen device over a unique number that is generated on the fly, valid for exactly one given transaction, and expires within five minutes?