A method and apparatus for conducting a commercial transaction over the Internet or other network connection are provided. Random numbers, which are unique for each user session, are pre-loaded onto a handheld, portable device, or token The random numbers are generated by external systems and delivered to the token for storage an internal memory and to a database accessible by an authentication system. The random numbers are dispensed by the token to a user by pressing a button on the token or otherwise signaling the token. A dispensed number is cross referenced, by the authentication system, to the database. The dispensed number authenticates the user or transaction.