When your client connects NAB to your bank statement request, the required security code is normally delivered via the NAB banking app.

If your client is unable to receive security tokens via the app, they can elect to have them delivered via SMS, to their mobile phone.

The screenshot below from the CashDeck client portal, shows this option.

For reference, if your client logged into NAB directly the bank may request a security code as shown below, these security codes expire in 5 minutes from the time they are created.