Abstract: Embodiments of the present invention relates to a multi-factor authentication system and method using an authentication device, a browsing device and an authentication server. Authentication requires a user to keep an authentication device within a certain proximity of a browsing device, and to authenticate locally to the authentication device using biometric information. The biometric information of the user is stored locally in the authentication device to prevent the need to transmit sensitive biometric information to an authentication server. The authentication server is capable of detecting unusual activity based on information received from the authentication device and the browsing device.