Question: I'm given a choice between two banks's authentication procedures and I need help choosing the most secure and convenient option.

Option "hardware token":
Authentication into the web platform is done via username/password but transactions are performed via a combination of PIN and a onetime hardware token key.

Option "fingerprint":
Authentication into the web platform is also done via username/password but transactions are performed by authenticating into a software token app on the phone via a fingerprint and getting a onetime token key.

My understanding is that the hardware token option is more secure because phones and laptops nowadays can easily be infected with keylogging and other kinds of software to eavesdrop on my passwords. However, the fingerprint authentication is a biometric form of authentication and as far as I know can only be spoofed with a physical fingerprint and not software, thus possibly providing the same level of security.

Another weak point could possibly be the risk of stealing the software token's seed.

What do you think I should choose? Is hardware token still the way to go or is biometric identification a sane alternative in my scenario?

Answer: 
short: I'd go for the Hardware token.

Long version: First things first: People have proven that it is possible to tamper with fingerprints in multiple ways. Probably the most common way is to recreate it from a fingerprint with a printer, but there are more options. You can see some of them in the article [7 ways to beat fingerprint biometrics](https://www.networkworld.com/article/2293129/data-center/data-center-120606-10-ways-to-beat-fingerprint-biometrics.html#slide1). There is a lot more than that though.

But also HW tokens have been proven "crackable". Its a little hard to tell from the little information we have. It really depends on the token. 
The much more important bit in this consideration (at least for me) is this: If your HW token's seed gets stolen, you can change it. In case your fingerprint (or its digital representation) becomes publicly available your options are pretty limited.

If it really uses the fingerprint to authenticate at the system this should be your consideration. But if this is used on your phone it might just really be a token that is in your phone and secured by the OS using the fingerprint reader to replace the password. In this case your phone is your HW token but it has no proper read protected memory such as the token (should have).
In this case: I'd go for the HW token as well.
For this multi-factor authentication I would choose the fingerprint option, for the ease of use (you don't have a thing that you might misplace). This is assuming that as the bank is offering both they believe them to both provide adequate security and would provide insurance for a successful attack on either. I don't think a biometric finger scanner app is as secure as a hardware token, as there exists online attacks if the mobile is compromised for example. The hardware token would have to be physically stolen from you for any attack that I am aware of (as another answer pointed out it should provide an air gap between the internet and the secret it contains).

Also with the fingerprint option you still have the chance of [this](https://www.theregister.co.uk/2005/04/04/fingerprint_merc_chop/) happening. It's an old story but it still gives me chills.