An invalid token cannot be used to authenticate a transaction - either because it has been used before or it's incorrect.