[landsman]

The last bank public samples cover: Tatra banka's B-mail, from remp2020's raw e-mail (2019) and tomaj/bank-mails-parser's fixtures (2015), both MIT. Samples only, no key pinned.

• The signed subject carries the transaction id and the direction: Kredit na ucte (ID=111219/320305-1). The first bank since Air Bank and Fio with an id to deduplicate on. The sentence's zvyseny / znizeny has to agree; Debet for money out is assumed, the samples having no outgoing subject. Another subject is refused.
• The key is known: the 2019 e-mail used selector mta, still published at tatrabanka.sk, RSA 2048, DNSSEC-secure, its fingerprint in the class and the page. Not pinned until a real e-mail confirms Tatra still signs with it.
• IBAN account (the fixture's is a valid fake; the sample's fails its check digits), ISO-8859-2, balance at the sentence's time in Europe/Bratislava.
• The symbols come from the payer's reference, text the payer wrote; one not in the /VS…/SS…/KS… form with ten digits at most leaves them out rather than refusing the payment (the sample's variable symbol has eleven). The reference line is required; Ucet protistrany is a name, and nothing labelled may follow it or the message.

Each of four guards was broken in turn and a test failed for each. make build: green.