Question: I'm given a choice between two banks's authentication procedures and I need help choosing the most secure and convenient option.

Option "hardware token":
Authentication into the web platform is done via username/password but transactions are performed via a combination of PIN and a onetime hardware token key.

Option "fingerprint":
Authentication into the web platform is also done via username/password but transactions are performed by authenticating into a software token app on the phone via a fingerprint and getting a onetime token key.

My understanding is that the hardware token option is more secure because phones and laptops nowadays can easily be infected with keylogging and other kinds of software to eavesdrop on my passwords. However, the fingerprint authentication is a biometric form of authentication and as far as I know can only be spoofed with a physical fingerprint and not software, thus possibly providing the same level of security.

Another weak point could possibly be the risk of stealing the software token's seed.

What do you think I should choose? Is hardware token still the way to go or is biometric identification a sane alternative in my scenario?

Answer: 
No option is inherently better than the other.

* phone token is vulnerable to malicious apps on your phone, but it can secure whole process.
* hardware token is pretty invulnerable itself, but the whole chain usually remains unsecured against phishing, MiM attack and malicious apps on your PC/browser.

While the hardware token itself is secure, the problem is that typically it doesn't tell you what kind of operation you're authorizing. It's very easy for an attacker to trick the user into generating OTP for him. That was pretty common attack on hardware-token secured banking few years ago, major hole was requiring OTP for login - it was trivial to exploit by falsely claiming that first attempt was wrong. **IF the software token provides key information about the operation being authorized, this risk is eliminated.**

So the question rather boils down to "what part of the chain is easier to secure?" If you're sure about security of your computer with browser, it's connection to the bank and (most importantly) your vigilance against phishing, then hardware token is better. If you don't install apps from untrusted sources, then the phone is probably easier to secure.

If the mobile token works offline (based on challenge-response codes) and you can dedicate a phone that's permanently offline after activating token app (airgap), it's by far the most secure solution (albeit most cumbersome).

Fingerprint is not the best security-wise. Correctly implemented password or PIN would be more secure. But if the data is stored properly in phone's hardware secure enclave, it's good enough.

Basically, both options can be implemented right or wrong.
It's actually a very easy choice.

Hardware token: You can lose it, or it can get stolen. But if that happens, it can be replaced.

Fingerprint: Very unlikely to lose, unlikely to be stolen. Can be copied without you noticing. Cannot be replaced.

Security is always relative. Today this one is more secure, tomorrow someone discovers a new attack on it. But the basic facts don't change.

If you do all or almost all your banking from home, where you can keep the hardware token safe, take that. If you do a lot of it on the road or from various places, the ease and convenience of the fingerprint wins out. This is fine IMHO from a security POV because with the fingerprint **alone** nobody can steal your money (still would need the username/password combo). Fingerprint alone I wouldn't consider very secure.