Does any know how these security tokens work? From my understanding, it shouldn't be too complicated for the the system to sync the server and phone's algorithm to the one in the security token.

At least that's how I'd imagine it would work.