An authentication system is disclosed which is configured, in response to receiving a request to authenticate a transaction, to send a first challenge to a mobile terminal via a first channel and, in response to receiving a first response to the first challenge to determine whether the first response is correct, to send a second challenge to the mobile terminal via a second, different channel and, in response to receiving a second response to the second challenge to determine whether the second response is correct, and, in dependence upon the first and second responses being correct, to signal that the transaction is authenticated.