Abstract: A personal wireless communication device (PWD) has a data store that stores a first unique code. A registration database, remote from the PWD, receives and stores the first code. The registration database transmits to the PWD a second unique code that is stored in the PWD. A data reader at the PWD reads a third unique code that is carried on a payment card to be authenticated. A code generator at the PWD generates a fourth unique code in response to user input at the PWD. A code generator at the PWD generates a unique encryption key utilising the first, second, third and fourth codes. The PWD encrypts a unique authorisation code using the unique encryption key that it has generated and transmit the encrypted authorisation code to the remote registration database, which decrypts the authorisation code to authenticate the payment card by reference to the authorisation code.