ah, thank you, khertan.

so the card and the website are synchronized (in a more true sense of the word than 80% of the time it's used these days). but then there must be a fairly accurate clock running inside that card, PLUS you couldn't really generate a new code every time you press the button on the card, like BoA says. there'd just be a new code every 30-60 seconds. they could narrow the intervals, i guess, but that would require an even more accurate clock and even calculating a new code every 5-10 seconds would really suck the juice out of a credit-card-size battery pretty fast, wouldn't it?