An authentication system is disclosed. Information associated with at least one of a user's use of a resource and demographic information associated with the user is collected. The collected information is processed to determine one or more stimuli to be presented to the user. The collected information is processed to determine one or more stimuli to be presented to the user. Classification data provided by the user is stored. Classification data associated with the user is received. The received classification data is compared to the stored classification data. A determination of whether to authorize an action based at least in part on the comparison is determined.