Abstract: Methods and Apparatus are disclosed for a multi-factor authentication service which permits customers and account holders to provide secure instructions to entities via their Internet enabled mobile telephone handsets. In preferred embodiments, requests to authorise account holder not present transactions are received from a merchant's terminal (90) and are routed through the bank's proprietary network (95) and the bank's information system (40) through to the Internet (50) and eventually the information management system (20) of the service operator. When the operator receives the request to contact the addressee and obtain instructions it sends out to the addressee an alert message inviting the addressee to log into the information manage system (20) so that the request can be provided and instructions obtained which are eventually routed back to the bank's information system (40) where the instructions are processed. The present invention provides multi-factor authentication.