Ah, I was confused. If you use your phone to generate the 8 digit key that allows you to login online, then that 8 digit key is indeed timed out after 60 seconds. But that is because the phone can talk to the bank and/or the phone has an accurate clock in it. In fact the phone is going to be able use a much more secure algorithm than the chip and pin reader as the phone can talk directly to the bank.
If you are using the old style physical card reader, then there is no 60 second time out as there is no real time clock in the card reader. Your debit card contains a sequence number (presumably set to a random number when the card is issued). The sequence number is included in the key I when it is generated, and updated and saved on the card each time you generate key I. And the bank knows the initial sequence number that was given to your card. So the bank knows the sequence of keys I1, I2, I3 etc that your card reader will generate. If it ever sees a key that does not form part of this sequence or a key is presented that has already been used, or a key is presented that has an earlier sequence number than a key that has been successfully used previously, then the login attempt will be rejected.
