This depends on the bank. Ex-PostBank ING clients get a TAN via SMS for every transaction (or a paper list of TANs if you really want it). Recently, they added that when you log in from a different machine/location than usual, you get a similar code via SMS (or from a different but similar paper list, I guess), called a PAC.