The token uses the same basic security feature as the TAC, which is the 2-factor authentication: what you know and what you have.  You know your login ID and password (factor 1).  You have your handphone/token (factor 2).
AFAIK it doesn't interact with the bank's system, it generates a code with relation to your account and the current time.  That's why you cannot generate many codes to be used later because the time does not match, and you cannot use other people's token for your login.  BTW, I've never had my HSBC token run out of sync despite pressing it many times to test it and write down numbers.

You can't pay for other bills at TM Point using credit card.