Are you sure its being done by e-banking?
First of all, I would say its impossible. Even though its just 5digit TAC, how many times he had to tried in order to get the right one. Must be through your atm or something. The chance of guessing the correct tac code is very small leh.. 1/99999.

Same thing like HSBC lar.
I rather use the 6pin generated to mobile phone lor.
That device have to carry here and there.
And most of the time, dont know why always out of sequence.