Its a shame they've not adopted the Google Authenticator app for their security. I use this on Google, Facebook and Dropbox amongst others and it works really well. Plus as there are Open Source implementations, its available for multiple devices.
I find it works well and reliably.
My fear is that with TFA becoming more popular and accepting, we're all going to have to carry around rucksacks stuffed full of OTP generators. The good lady already frets about making sure she's got her HSBC pin generator when she needs it. If companies aren't careful, they'll end up loosing business because TFA is too complicated to manage.