There are a number of options that would work for the client:
1. The web access number can be changed
2. The web access number is only required to be entered the first time, but it doesn’t ask for this for every subsequent time (only for the password as per many banking institutions)
3. The web access number is the nominated e-mail address

If the web access number is required to be entered every time, and it isn’t the clients e-mail address, and it can’t be changed, this is completely unworkable for the client, and won’t work as an ap on the phone.

No-one will carry around with them or remember an eight digit random web access number to enter every time they log in on their phone. It will cause frustration for clients and defeat the objective of all of the hard work that has been put into developing this ap. No-one will use it.