It is presented a method for authenticating a candidate individual, comprising the steps of: obtaining candidate biometric data related to the candidate individual; obtaining a first data item related to first reference biometric data from a data carrier, wherein any significant part of the first reference biometric data is not readily available from the first data item; obtaining a second data item related to the first reference biometric data from digital storage, wherein any significant part of the first reference biometric data is not readily available from the second data item; working out a second reference biometric data using the first data item and the second data item; and authenticating the candidate individual (101′) when the candidate biometric data is determined to correspond to the first reference biometric data using the second reference biometric data and the candidate biometric data. Corresponding authentication apparatus, data carrier issuing apparatus and ticket are also presented.