Get the Physical Token mostly. There is just no way people can bypass that one.
Pretty sure they can somehow phone-jack it.