TANs (Transaction Number) can only be used for personal transactions. Your bank will never ask you to enter a TAN for prize draws, security updates or to refund money to your account. Hence, please always use caution if you are asked for your bank details or a TAN when you are not actually making a transaction.
Your Sparkasse will never ask you by e-mail to enter personal details such as your account number, PIN, TAN or credit card details on a website.
That means, always be careful to open e-mails, SMS or MMS that are supposedly from your bank. Only install programs from trustworthy sources.