Fair enough. But aren't these TAN codes usually used as 2FA for logging in on a PC (instead of a phone app)?

Speaking about the case where you opened the banking website on your phone.

And while it is true that you can sniff data on the internet as well, that usually comes with * having gained access to one of the bank's servers so that you can log traffic there (in that case you wouldn't really be sniffing data anyway...I guess) * you managed to get a worm or trojan horse on the victim's computer (again, easier to just keylog everything...probably) * you managed to get access to a DNS server or a server inside the ISP's network so that you can re-route traffic/listen to traffic.

Most probable is the 2nd way and there are easy ways to protect yourself against that. At least on a computer, not so much on a smartphone. To be specific I don't know of any way to protect yourself, or even to find out that you are infected when it comes to smartphones and their operating systems.

When it comes to intercepting GSM traffic you just need some money to buy or build a GSM listener (a GSM relay should do the job just fine) a tiny bit of knowledge about how these things work (wikipedia) and that's about it.