Many banks these days offer online banking (in a web browser). To increase security, most banks require a standard login with a username (account number) and password, plus a code that is sent to your mobile phone to two-factor authenticate the login and/or any transaction.
I am thinking of switching to a bank that uses a different scheme: In order to login online (say from your home computer), it just requires your account number (no password needed). The bank then provides a challenge (a few digits), which you must then enter into a dedicated mobile phone app. To increase security, the app requires you to hold a physical card (with a chip) to your phone (which I am guessing will use NFC) and to "unlock" the card with a pin (known only to you), which you type into your phone. If the pin is correct (matches the pin of the card), the phone will hash the challenge digits into a passcode, which you then type into your web browser. This then gives you access to the online banking platform. The same procedure is used when trying to issue a transaction.
I found a press release from when this technology was developed here. The article doesn't say much about the security, though.
I am wondering how secure this is. Let us assume we have an attacker that was able to completely compromise my phone to the root level (some exploits pop up from time to time that allow this, so it's not unheard of). So, we assume the attacker can intercept everything I type on the phone and can monitor everything that every app on the phone does (including memory accesses). We will further assume that the attacker knows the bank account number and who it belongs to, but does not have physical access to the card or the chip on it.
If I now used this app and activated the card's NFC and typed in the pin, would the attacker be able to copy everything he needs from the card to phone, thus allowing him to authenticate himself (in the future without the card) and gain complete access to my bank account?
Or am I wrong in worrying and does reading from the card change its state in a way that is unpredictable to the reading device, ensuring that even if I authenticate myself multiple times on a compromised phone, the attacker would still need physical access to the card itself before he can do any damage?