For Packstation they had some serious problems with phishing. At first you only needed your Packstation User Number and the PIN. They then disallowed logins with user number and required the membership card. But it seems they started skimming those, so starting from last month they send you a TAN to your cellphone when the package arrives and you need card+TAN.

From what I see Bufferbox right now only has a few locations, for Packstation its over 2500 locations and a wide userbase, as with software: the wider the user-base the bigger the profit for bad guys.

I wouldn't call it solid: All that the 'bad guy' needs to go shopping with a stolen CC is control over an email box of a BufferBox customer. DHL had to learn it the hard way, and I'm sure they didn't come up with two factor authentication (card+pin knowledge) and out-of-band (SMS) PIN transmission without a reason. We'll see how it works out in the US..