I have the HSBC app and use it quite frequently. Initially I used the physical fob to generate codes and then later switched to the digital code generator in the HSBC app. However, since enabling bio-metrics within the app, I am no longer required to generate codes to authorize logging on to the app or executing transfers, payments etc. All authorisations are done via my fingerprint. I have a VPN (Surfshark) but don't activate it when using the HSBC app even when out and about, as I have a permanent internet connection from a Thai sim card. I would only use the VPN if I was using a public wifi in a bar/hotel/cafe etc. Hope this info is of use to you.