Update: I now know the description below to be inaccurate. See the comments section below.
Here is my guess at how the new HSBC SecureKey device works…
Each device has its own method for generating a long sequence of 6-digit numbers (example: divide the previous number by 13, add 5, and swap the second and fourth digits around). That method is known only to the device itself, and HSBC’s central database. That database stores, for each device serial number, (1) how that device’s sequence is generated, and (2) where the device is currently at in the sequence. When you press the green button after entering your PIN, the next 6-digit number in the sequence is generated and shown. When you type that number into the HSBC login page, HSBC updates its database to advance to the next number in the sequence, and checks that it matches the number you entered.
This process will eventually, after several years, exhaust the sequence of 6-digit numbers. Thereupon, the sequence will begin all over again.
A slight refinement is necessary. I can make my device get ‘out of sync’ with the HSBC database by repeatedly pressing the green button, but not trying to log in using the numbers it generates. To address this situation, the HSBC login page must accept not merely the very next number in the sequence, but any of the next, say, hundred numbers, and update its database accordingly.