The card reader when supplied probably has a unique to your account mirror image of the processing algorithms stored at head office, so it knows in advance cronologically what code will be provided by its card in your standalone device.
This is the somewhat long-winded security system my partner has with her NatWest account, causing me to question how it worked. Thankfully it doesn't need to be used for general online login.
