I lost my bank papers/statement on the train

Shouldn’t be enough to set up accounts elsewhere, but I would notify your current bank that you are at risk of impersonation. They should be able to set up additional safety measures.

As I was getting off the train, I think I left a letter with a bank statement on.
I did order a new card and new pin.
It will be a completely new long center number, last three digits.
With nationwide, online wise, they ask for a customer number, passcode and phone verification. Which in my opinion is very secure.
I'm not sure about the app. They may have my address details.
If someone has access, they cannot just set up a new payee and transfer money? Use my money

I can't see there would be much benefit in ordering a new card, if what you had lost was a bank statement and a letter. Your card number wouldn't appear on your bank statement.
Your bank statement would have your account number and sort code, and the letter presumably would include your address. But the only way to take money from your account with that information would be to set up a direct debit. But banks only allow trusted organisations to initiate direct debits. And even if someone did set up a direct debit you'd be able to reclaim any money taken without your authorisation.
I agree with @Admit-One that you should contact your bank just to let them know. But I don't think this is something you need to worry about unduly. But be sure to keep an eye on your bank statements for any transactions you don't recognise. (Though you should be doing that in any case.)

As above, keep an eye on it but the chances of someone being able to access your accounts with it is miniscule. For my bank (HboS) none of the info you would be asked to log in would be included on the statement - no user name, no passwords, no memorable questions etc, and even if logged in I can't set up a new payment without authenticating it on my phone. Even someone walking physically into a branch and pretending they'd been locked out online etc wouldn't get far with just a single statement. As soon as you couldn't produce any ID, tell them your date of birth or how many accounts you have etc they'd likely smell a rat and call the police.
99% it's just been chucked out.

Thank you.
When I asked for a new card, the online customer service staff only asked "what is my post code". Which is on my statement.
However, the card cannot be posted to another address.

As above the card and pin aren't directly related to your bank statement, there wasn't any need to order new ones but I get it was an impulsive thing.
I'm a bit confused though, was your post code the one and only piece of security information the bank asked you for? they didn't make you login using account details or passwords etc to get to that point?

I logged into the online chat and that is where they asked me my post code, which is strange as I thought they would have more secure questions.

That's why I'm getting at tho, you had to log in using username/password/memorable letters to get to the online chat right? (They could never just use the postcode, as that applies to a whole street, not an individual)
From what I remember ordering a new card is seen as quite low risk since it only goes to the verified address they already have. Compared to trying to send 5k to a new payee out of nowhere for example, where they would freak out, transfer you straight to the fraud team and carry out pretty much every check possible.

Yes I logged in using username, passcode, memorable letters to get to the online chat.
I'm still waiting for my new card to arrive.
However, thank goodness all banks have a lot of security protocols and checks to access banking.