A system for authenticating the calling device used to place a call to an enterprise call center. The system uses a premise component, a cloud-based Call Authentication Service (CAS), and orchestration between these two components. The premise component includes a number of sub-components including servers and probes. The CAS includes a Decision Engine that utilizes a number and variety of authentication plugins. The disclosed system may be used independently or as part of a multi-factor authentication strategy with other techniques such as reduced Knowledge-Based Authentication or voice biometrics.