A computer system is configured to authenticate the identity of a user who is attempting to access a website or conduct a transaction. The system is configured to receive a geographical location associated with the user and to receive the geographical location of a mobile phone associated with the user, and to determine whether the two geographical locations are within an acceptable distance.