If you're talking about RSA tokens as in the tokens sold by RSA Security the company, my company uses them and my team is in charge of their issuance. We've est

If you're talking about RSA tokens as in the tokens sold by RSA Security the company, my company uses them and my team is in charge of their issuance. We've estimated the total including man-hours cost of issuing a single token at about 250€. Sure in the grand scheme of things it isn't much but I can't imagine it'd be better for PayPal, and that gets expensive fast if you send them to clients and not just employees. Part of this is of course genuine security verifications but a lot of it is due to RSA Security's obtuse design decisions. We tend to avoid them entirely and instead rely on modern SAML providers with app-based 2FA whenever we can now.