The hardware dongle sounds like it might be TOTP. There are plenty of clients for that for laptops and phones, assuming you can enroll your own secret.

likely, but it's a custom time based token from RSA that you definitely will never get the keys out. so the implementation doesn't matter much.

Unfortunately it's not plain TOTP. Most banks in Europe give you a standalone cheap plastic smart card reader into which you put your bank card.

The website shows you a code. You input it into the reader, followed by your card PIN. The reader outputs a code you put into the website.

This is what it looks like:

https://www.post.ch/-/media/portal-opp/k/bilder/postgeschich...