The security token that is mailed is numeric only. The one-time passcode expires 15 minutes after the email is sent. If the token expires the user can request another one.