A method comprising: receiving, by a server computer, a request message from a token requestor computer on behalf of a user device, the request message comprising a first current token tracking value (tATV), a first function index value (fi), and a first control token tracking value (ctATV); determining, by the server computer, a second function index value (fi) based on a digit of a current time; comparing, by the server computer, the first function index value (fi) to the second function index value (fi); if the first function index value (fi) and the second function index value (fi) match, determining, by the server computer, a function (f) based on the first function index value (fi) and a stored function table associated with the user device by retrieving, by the server computer, a stored control token tracking value (ctATV) from a token service computer; and determining, by the server computer, the function based on the first function index value (fi), the stored function table associated with the user device, and the stored control token tracking value (ctATV); determining, by the server computer, a second current token tracking value (tATV) based on the function (f); comparing, by the server computer, the first current token tracking value (tATV) to the second current token tracking value (tATV); if the first current token tracking value (tATV) matches the second current token tracking value (tATV), comparing, by the server computer, the received first control token tracking value (ctATV) to the stored control token tracking value (ctATV); comparing, by the server computer, the first current token tracking value (tATV) and the stored control token tracking value (ctATV); if the first current token tracking value (tATV) and the second control token tracking value (ctATV) match, determining, by the server computer, that the user device is a malicious user device, and in response to the determination: generating, by the server computer, a replacement control token tracking value (ctATV); storing, by the server computer, the replacement control token tracking value (ctATV) in the token service computer; and generating, by the server computer, a replay attack alert message comprising at least the replacement control token tracking value. receiving, by a server computer, a request message from a token requestor computer on behalf of a user device, the request message comprising a first current token tracking value (tATV), a first function index value (fi), and a first control token tracking value (ctATV); determining, by the server computer, a second function index value (fi) based on a digit of a current time; comparing, by the server computer, the first function index value (fi) to the second function index value (fi); if the first function index value (fi) and the second function index value (fi) match, determining, by the server computer, a function (f) based on the first function index value (fi) and a stored function table associated with the user device by retrieving, by the server computer, a stored control token tracking value (ctATV) from a token service computer; and determining, by the server computer, the function based on the first function index value (fi), the stored function table associated with the user device, and the stored control token tracking value (ctATV); retrieving, by the server computer, a stored control token tracking value (ctATV) from a token service computer; and determining, by the server computer, the function based on the first function index value (fi), the stored function table associated with the user device, and the stored control token tracking value (ctATV); determining, by the server computer, a second current token tracking value (tATV) based on the function (f); comparing, by the server computer, the first current token tracking value (tATV) to the second current token tracking value (tATV); if the first current token tracking value (tATV) matches the second current token tracking value (tATV), comparing, by the server computer, the received first control token tracking value (ctATV) to the stored control token tracking value (ctATV); comparing, by the server computer, the first current token tracking value (tATV) and the stored control token tracking value (ctATV); if the first current token tracking value (tATV) and the second control token tracking value (ctATV) match, determining, by the server computer, that the user device is a malicious user device, and in response to the determination: generating, by the server computer, a replacement control token tracking value (ctATV); storing, by the server computer, the replacement control token tracking value (ctATV) in the token service computer; and generating, by the server computer, a replay attack alert message comprising at least the replacement control token tracking value. generating, by the server computer, a replacement control token tracking value (ctATV); storing, by the server computer, the replacement control token tracking value (ctATV) in the token service computer; and generating, by the server computer, a replay attack alert message comprising at least the replacement control token tracking value.