I don't know exactly how it's implemented (tptacek and cperciva would probably have a field day with it) but I think the idea is to prevent exactly such replay

I don't know exactly how it's implemented (tptacek and cperciva would probably have a field day with it) but I think the idea is to prevent exactly such replay attacks by generating the challenge on the bank's central servers.