Multi-factor authentication apparatus pre-loads a first factor, for example a passcode, to user equipment such as a mobile telephone. The user subsequently initiates access to a protected product or service, triggering the apparatus to run a multi-factor authentication process, via an access device such as a computer connected to the Internet. The user enters the pre-loaded first factor, together with another factor such as a UserID and PIN. The pre-loading avoids vulnerability to communications problems at the time the user initiates access. Pre-loading is done every time an access session terminates for the user, either successful or failed and a user profile data store is used to manage passcodes in a manner that allows incorrectly entered first factors to be retried when delivery to user equipment is not possible.