A method and system authenticate a transaction between a user and a payment system. The information of the transaction is transmitted through a secure communications from the user to the payment system, and the authentication message is sent from a payment system to the user via an authentication system. The authentication message is sent from the authentication system from one of multiplicity of addresses to the user, and the response to the message is received in that address. Additional security is achieved when the reply addresses are selected randomly.