Wondering if it works the way it does in the movies, where people only need an account number and a password to access their Swiss bank account.
I can not talk about Switzerland, but I don't think things are much different than in Germany.
In Germany, you log in with your user name (which may or may not be the account number) and PIN (not the pin from the card, but a different one). This allows you to view the last account balances and other stuff.
In order to make orders like wire transfers etc., you need to approve every order with a TAN (transaction number). The way to do that has changed over the last decades.
In earlier times, you had a list of TANs where you could use any of them. As people got more and more scam emails asking them to enter the PIN and one ore more TANs on fake websites, they changed the methods:
- iTAN (indexed TANs) are lists as before, but each TAN has an index. Now you are asked to enter the exact TAN matching the index they tell you.
- mTAN (mobile TAN): they text you the TAN to use to your mobile phone.
- pushTAN: like mTAN, but you get the TAN via an app on your smartphone.
- chipTAN: you get a device for calculating the next TAN, matching the transaction data
All those TAN methods serve to add another layer of authentification.
I hope this answers your question.
I expect it depends on the sort of account. I used to have a Swiss bank account - not one of the secret numbered ones, but just a normal account (because I worked there for a while). I could withdraw money from US ATMs with just the card and PIN. For online access, there was a physical security thing (like a cheap calculator) that did a one-time security challenge code each time you logged in. So you'd need to get card/PIN or security thing and its password.
This was about a decade ago. I would expect the numbered accounts have something even stricter these days.