Sources: http://www.die-bank.de/news/comeback-der-klassiker-8058/
and http://www.die-bank.de/fileadmin/pdf/diebank_8_2016_TOP100_web.pdf

This list will be extended to the top 100 banks soon.

How are the results presented? Our analysis focuses on the following aspects: whether tracking services are used ("NoTrack" category), whether selected attacks are prevented, the quality of encryption during data transmission to the website (EncWeb), and the quality when sending e-mails to an existing e-mail server (EncMail). You can control how important these four criteria are for you with the arrows in the column headings.

What exactly is checked and what do the results mean? We check the internet addresses with several techniques, which we have described in detail in a research paper. You can display a list of all checks and explanations of their relevance by clicking on the address of a web page to display its detailed results.

What is the purpose of PrivacyScore? With PrivacyScore we make websites publicly comparable in terms of selected properties. As scientists, we are interested in how users and operators deal with this form of transparency. Among other things, this raises the question of whether website operators have an additional incentive to improve their websites.

What can be concluded from the results, what not?

No statement about the importance of the categories. The table sorts the listed web pages according to the importance you specify. The further up a website is sorted, the more tests it has passed in the respective categories. In the event of a tie, the following category will decide. The default sorting is according to the category "No Track", followed by "EncWeb", "Attacks", and "EncMail". However, this default ranking should not be interpreted as an indication of the importance of the categories.

No statement on necessity. The fact that a web page is ranked at the lower end says nothing about its absolute security level. The results shown on this page merely provide information on how the listed websites perform in a direct comparison. Some security mechanisms are only necessary to protect against strong attacks (e.g., governments).

Limited expressiveness. The results cover only security mechanisms that can be observed from outside when visiting the specified Internet addresses. It is quite possible that an operator uses additional internal protection mechanisms and therefore has decided to leave out some externally visible mechanisms. Furthermore, it is possible that additional security mechanisms are used on individual pages (e.g., for the transmission of passwords). However, such variations are not taken into account in the analysis. Therefore, one cannot conclude from the failure of individual tests that a provider does not handle personal data with sufficient care. On the other hand, however, it is also possible that a website has serious security holes, although it achieves a good result on this page.

Sorting and grouping