Paypal’s Security Key generates a unique one-time-use password every 30 seconds. This way, even if phishers get your login and password, they won’t be able to log into your Paypal account without the key generated by your hardware. If phishers learn your specific keygen algorithm (unlikely), you’re out of luck. If they do manage to get you to enter a phishing site, they have up to 30 seconds to use that info to log in and transfer cash out.”]
Source: https://gizmodo.com/paypals-security-key-protects-you-from-phishers-228824