README

A PHP library implementing the following functions of the FinTS/HBCI protocol:

Get accounts
Get balance
Get transactions
Get credit card transactions (see below)
Execute direct debit
Execute transfer
Note that any other functions mentioned in section C of the specification should be relatively straightfoward to implement.

Forked from mschindler83/fints-hbci-php, but then mostly reimplemented.

Getting Started

Before using this library (or any other FinTS library), you have to register your application with Die Deutsche Kreditwirtschaft in order to get your registration number. Note that this process can take several weeks. First you receive your registration number after a couple days, but then you have to wait anywhere between 0 and 8+ weeks for the registration to reach your bank's server. If you have multiple banks, it probably reaches them at different times.

Further prerequisites:

to avoid error messages like: "Cannot use nemiah/php-fints's latest version 4.0.0 as it requires ext-mbstring * which is missing from your platform." just install php-mbstring in advance.
to avoid error messages like "As there is no 'unzip' nor '7z' command installed zip files are being unpacked using the PHP zip extension." just install unzip or 7z in advance to coninuing to next step.

Then install the library via composer:

composer require nemiah/php-fints

See the examples in the "Samples" folder to get started on your code. Fill out the required configuration in init.php (server details can be obtained at https://www.fints.org after registration). Then execute tanModesAndMedia.php and later login.php. Once you are able to login without any issues, you can move on to the other examples.

Credit card transactions

Credit card accounts have no IBAN. They are therefore not returned by GetSEPAAccounts (HKSPA) and their transactions cannot be retrieved with GetStatementOfAccount (HKKAZ) or GetStatementOfAccountXML (HKCAZ). Instead they use DKKKU, a business transaction defined by the Deutsche Kreditwirtschaft rather than by the FinTS specification, which not every bank offers.

The accounts are found in the UPD, which the bank sends during login, so listing them costs no request:

$getCards = \Fhp\Action\GetCreditCardAccounts::create();
$fints->execute($getCards);
$cards = $getCards->getAccounts();

$getTransactions = \Fhp\Action\GetCreditCardStatement::create($cards[0], $from, $to);
$fints->execute($getTransactions);
if ($getTransactions->needsTan()) {
    handleStrongAuthentication($getTransactions);
}
foreach ($getTransactions->getStatement()->getTransactions() as $transaction) {
    echo $transaction->getBookingDate()->format('Y-m-d') . ' '
        . $transaction->getAmount() . ' ' . $transaction->getCurrency() . ' '
        . $transaction->getPurpose() . PHP_EOL;
}

See Samples/creditCardStatement.php for a complete example. Note that:

A single account can cover several physical cards, possibly of different schemes. The account number looks like a card number but generally is not a valid one. Which card a transaction belongs to is usually indicated in its purpose.
A single request may not span more than the period the bank reports as "Speicherzeitraum" in the DIKKUS parameters, and GetCreditCardStatement rejects wider ranges. Banks do not refuse them themselves, they just answer inconsistently — the tested one served a range twice that period in full on one attempt and returned an empty page on the next, and silently truncated a much wider one. Note that the period is not necessarily how far back the data goes: the tested bank happily served much older transactions when asked for them in windows of the permitted width.
Transactions in a foreign currency additionally report the original amount, its currency and the exchange rate that was applied.

Banks with special needs

If you are developing an online banking application with this library, please be aware of the following exceptions:

Hypovereinsbank

The BLZ 71120078 will throw an "Unbekanntes Kreditinstitut" exception when used with the URL https://hbci-01.hypovereinsbank.de/bank/hbci. You have to use BLZ 70020270 instead.

if (trim($url) == 'https://hbci-01.hypovereinsbank.de/bank/hbci')
	$blz = '70020270';

ING Diba

This bank does not support PSD2:

if (trim($blz) == "50010517")
	$fints->selectTanMode(new Fhp\Model\NoPsd2TanMode());

Contribute

Contributions are welcome! See the developer guide for some background information.

We use a slightly modified version of the Symfony Coding-Style. Please run

composer update

and

composer cs-fix

before sending a PR.

Bank compatibility

Different banks implement different versions of the HBCI and FinTS specifications, and they also interpret the specification differently sometimes. In addition, banks behave differently (within the boundaries of the specification) when it comes to validation (some may tolerate slightly wrong requests), TANs (some ask for TANs more often than others) and allowed parameters (not all banks support all parameter combinations).

This library aims to be compatible with all banks that support FinTS V3.0 and PIN/TAN-based authentication according to PSD2 regulations, which includes most relevant German banks. Currently, it works with the most popular banks at least, and probably with most others too. Some corner cases (e.g. Mehrfach-TANs or SMS-Abbuchungskonto for mTAN fees) are not and probably will not be supported. Those banks with a dedicated integration test have been tested most extensively.

If you encounter any problems with your particular bank, please check for open GitHub issues or open a new one.

nemiah / php-fints

Maintainers

Package info

Statistics

Security