First, I think chipTAN is not publicly documented, and given banks' track record in security matters, I certainly would not want to trust a system that is not publicly documented, and secondly, using a card that I am supposed to carry around all day instead of putting it into my safe at home for transaction authentication doesn't sound like that bright an idea to me.
mTAN is completely braindead, of course, given the essentially non-existent security of mobile networks.
While that are definitely a valid concerns I prefer that closed undocumented system over others that have actively been used to steal money(sometimes even undetected for some days). The probability that a virus infects my computer is (even with up-to-date software and AV) magnitudes greater than someone breaking the debit card transaction authentication.
So until something better comes around chipTANs "hopefully/maybe some level of cryptographic based security" beats "sheet of paper with no verification at all" ;).
Are you sure that you don't mean "especially with AV"? AV is an attack surface, not a security mechanism.
Also, how do you know that chipTAN has not been used for stealing money yet? Criminals commonly don't publish their methods, and as far as banks are concerned, the customer did something wrong and is lying unless the customer can prove that the (proprietary) security system is broken. Not exactly favourable conditions for finding out about security problems.
Also, how do you know that finding a security flaw in chipTAN/some chipTAN implementation is more difficult than finding a security flaw in your webbrowser for someone who is motivated by the monetary reward of doing so? You are aware of the gaping security holes in GSM SIM card software, for example?
I think you are making a whole lot of not particularly well-supported assumptions there.
First, I think chipTAN is not publicly documented, and given banks' track record in security matters, I certainly would not want to trust a system that is not publicly documented, and secondly, using a card that I am supposed to carry around all day instead of putting it into my safe at home for transaction authentication doesn't sound like that bright an idea to me.
mTAN is completely braindead, of course, given the essentially non-existent security of mobile networks.