A method for enhancing security of a communication device when conducting a transaction using the communication device, the method comprising: receiving, from a remote computer, a first limited-use key, LUK, that is associated with a set of one or more limited-use thresholds that limit usage of the first LUK; generating, by the communication device, a transaction cryptogram using the first LUK; and sending, to an access device, a token instead of a real account identifier and the transaction cryptogram to conduct the transaction, wherein the transaction is authorized based on at least whether usage of the first LUK has exceeded the set of one or more limited-use thresholds, characterized in that the set of one or more limited-use thresholds includes a limited-use threshold indicating a predetermined number of more than one transaction that the first LUK is valid for, the method further comprising: sending, to the remote computer by the communication device, a replenishment request for a second LUK, the replenishment request including transaction log information derived from transaction data of each of a plurality of transactions conducted using the first LUK, the transaction data being stored in a transaction log on the communication device; the remote computer performing verification of the transaction log information in the replenishment request, wherein the remote computer has tracked the transaction activity of the account; and receiving, from the remote computer by the communication device, the second LUK when the remote computer has verified the transaction log information in the replenishment request, wherein the transaction log information includes a message authentication code computed over at least the transaction log using the first LUK as an encryption key. receiving, from a remote computer, a first limited-use key, LUK, that is associated with a set of one or more limited-use thresholds that limit usage of the first LUK; generating, by the communication device, a transaction cryptogram using the first LUK; and sending, to an access device, a token instead of a real account identifier and the transaction cryptogram to conduct the transaction, wherein the transaction is authorized based on at least whether usage of the first LUK has exceeded the set of one or more limited-use thresholds, characterized in that the set of one or more limited-use thresholds includes a limited-use threshold indicating a predetermined number of more than one transaction that the first LUK is valid for, the method further comprising: sending, to the remote computer by the communication device, a replenishment request for a second LUK, the replenishment request including transaction log information derived from transaction data of each of a plurality of transactions conducted using the first LUK, the transaction data being stored in a transaction log on the communication device; the remote computer performing verification of the transaction log information in the replenishment request, wherein the remote computer has tracked the transaction activity of the account; and receiving, from the remote computer by the communication device, the second LUK when the remote computer has verified the transaction log information in the replenishment request, wherein the transaction log information includes a message authentication code computed over at least the transaction log using the first LUK as an encryption key. sending, to the remote computer by the communication device, a replenishment request for a second LUK, the replenishment request including transaction log information derived from transaction data of each of a plurality of transactions conducted using the first LUK, the transaction data being stored in a transaction log on the communication device; the remote computer performing verification of the transaction log information in the replenishment request, wherein the remote computer has tracked the transaction activity of the account; and receiving, from the remote computer by the communication device, the second LUK when the remote computer has verified the transaction log information in the replenishment request, wherein the transaction log information includes a message authentication code computed over at least the transaction log using the first LUK as an encryption key.