Hmm, there are some corner cases here I think. Imagine being logged in on two devices, one is online and one is offline. On the online device you regenerate your CVC token: your offline device will be out of sync. And for the rotating CVC it's also not an option, this would only work for static CVC codes. bunq would need to consinder those corner cases then. 🙂