So, when i do an online payment transaction i "[sign](http://security.stackexchange.com/questions/33183/where-is-rsa-digital-signature-used-in-the-online-banking-world)" my transaction with my digipass using some sort of a MAC (HMAC) with a shared key and some information that is unique for this transaction. 

But using this scheme, how can a bank "proof" later (in court for example) that you did this tranaction? The bank has to store the same shared key? With RSA digital signatures they can claim that only i could sign this transaction because only i have the private key matching the public key. But here the key is symmetric (the shared key between you and the bank)? 

How is this done? Can it be done? Is there some sort of formal standard that banks use? 

Thanks (as always) for your help!