diff --git a/src/message.ts b/src/message.ts
index 4b4dfe7..26e5c4c 100644
--- a/src/message.ts
+++ b/src/message.ts
@@ -185,9 +185,13 @@ export class CustomerMessage extends Message {
 
 			const now = new Date();
 
+			// The encryption header carries the same security profile as the
+			// signature: PIN version 2 for a two-step TAN method, 1 for one-step.
+			// Some banks (Consorsbank, BLZ 76030080) reject a two-step dialog whose
+			// HNVSK still says PIN:1 with "9010 Ungültiger Signaturaufbau".
 			const hnvsk: HNVSKSegment = {
 				header: { segId: HNVSK.Id, segNr: 998, version: HNVSK.Version },
-				secProfile: { secMethod: 'PIN', secVersion: 1 },
+				secProfile: { secMethod: 'PIN', secVersion: firstSignature.secProfile.secVersion },
 				secFunc: 998,
 				secRole: 1,
 				secId: { partyType: 1, partyId: firstSignature.secId.partyId },
diff --git a/src/tests/message.test.ts b/src/tests/message.test.ts
index b642547..e5357fc 100644
--- a/src/tests/message.test.ts
+++ b/src/tests/message.test.ts
@@ -104,4 +104,27 @@ describe('CustomerMessage', () => {
 
 		const _message = Message.decode(encodedMessage);
 	});
+	it('encrypts with the security profile version of the signature (two-step: PIN:2)', () => {
+		const customerMessage = new CustomerMessage('0', 1);
+
+		customerMessage.addSegment(hkidn);
+		customerMessage.addSegment(hkvvb);
+		customerMessage.sign(280, '12030000', '12345678', '123', '0', 900, '12345');
+		const encodedMessage = customerMessage.encode();
+
+		expect(encodedMessage).toContain("'HNVSK:998:3+PIN:2+998+");
+		expect(encodedMessage).toContain('HNSHK:2:4+PIN:2+900+');
+	});
+
+	it('encrypts with the security profile version of the signature (one-step: PIN:1)', () => {
+		const customerMessage = new CustomerMessage('0', 1);
+
+		customerMessage.addSegment(hkidn);
+		customerMessage.addSegment(hkvvb);
+		customerMessage.sign(280, '12030000', '12345678', '123', '0');
+		const encodedMessage = customerMessage.encode();
+
+		expect(encodedMessage).toContain("'HNVSK:998:3+PIN:1+998+");
+		expect(encodedMessage).toContain('HNSHK:2:4+PIN:1+999+');
+	});
 });