The victim is asked to enter the SMS-delivered TAN they receive from the bank into the fake web form, as a way to complete this security process.