They do two-factor authentication: you put in a passphrase and/or a debit card and it generates a token that you enter on your bank's website before you can make a transaction. The purpose is to make it impossible for somebody who has installed a keylogger on your computer to transfer money from your account by using your password. Other banks use your mobile phone: they send an SMS with a token to your phone, which you enter on their website.
A problem with them is that somebody can install a program on your computer that intercepts the code you enter, and then makes a different transaction than the one you intended to make. In this sense SMS based tokens are safer, because the banks send the amount of money and the recipient in the SMS along with the code. If a program was installed that changed the recipient and/or the amount, you'd be able to detect this in the SMS because then the SMS would display the wrong recipient and/or amount. On the other hand, your smartphone can nowadays be infected too, which those key generators cannot be...
Ah, right. In the UK they have the ones that read the credit card, in Greece we have simple number generators. Every bank uses them, though (I didn't know what they were called, we call them "tokens").
A problem with them is that somebody can install a program on your computer that intercepts the code you enter, and then makes a different transaction than the one you intended to make. In this sense SMS based tokens are safer, because the banks send the amount of money and the recipient in the SMS along with the code. If a program was installed that changed the recipient and/or the amount, you'd be able to detect this in the SMS because then the SMS would display the wrong recipient and/or amount. On the other hand, your smartphone can nowadays be infected too, which those key generators cannot be...