An existing communications device, such as a WAP-enabled mobile phone or other device, can be used as an authentication token. This has the advantage that WAP-enabled devices include components which are used in public key/private key cryptographic systems as a part of their standard communication functions. These components therefore advantageously allow the device to be used as an authentication token when communicating with a remote server.