Is he pushing the button multiple times between logins? Maybe inadvertently? I believe more than three pushes without a successful login makes it fall out of sync.
Is there a way to do this? I have a subset of users who work in an environment where they cannot have their cell phones. I recognize they can push cancel and then enter the passcode, but if I can reduce a step for them that will make this user a ba...