A financial institution may flag suspicious transactions that are conducted using an NFC-enabled mobile phone. The account holder establishes a second PIN that is separate from the primary PIN used by the customer to authenticate transactions. When a transaction is flagged, a message is sent to the customer at the mobile phone requesting entry of the second PIN. If the second PIN is not correctly entered, activity on the account is suspended.