A method of conducting a transaction, wherein a mobile device (112, 901) of a consumer has a mobile-based credential and an associated alias that identifies the mobile device (112, 901), wherein the mobile device (112, 901) includes a cryptographic module (113, 600, 700, 800, 1000) having a secure store element (604, 804, 1010) for storing the mobile-based credential and a secure accessing element (602, 802, 1020) for accessing the secure store element (604, 804, 1010), wherein the secure store element (604, 804, 1010) comprises a secure memory (902, 622, 822) for storing the mobile-based credential, the method comprising the steps of: receiving (228, 302, 322, 342, 502), by the mobile device (112, 901), a request for the mobile-based credential from a remotely accessible server (108, 950, 1104), wherein the request is received by the mobile device (112, 901) in response to a requestor device (122, 930) receiving the alias from the consumer and providing the alias to the remotely accessible server (108, 950, 1104), and the mobile-based credential being a decryption key corresponding to encrypted payment credentials; accessing (304, 350, 508), by the mobile device (112, 901), the mobile-based credential from the secure memory (902, 622, 822) by using the secure accessing element (602, 802, 1020) to certifiably request and receive the mobile-based credential from the secure store element (604, 804, 1010) over a certified communication interface (634, 834, 1030); and transmitting (234, 318, 330, 352, 510), by the mobile device (112, 901), the mobile-based credential to the remotely accessible server (108, 950, 1104), wherein the mobile-based credential is used at the remotely accessible server (108, 950, 1104) in combination with a server-based credential stored thereat for obtaining payment credentials to complete the transaction, the server-based credential being the encrypted payment credentials, and wherein the secure store element (604, 804, 1010) is exposed to the secure accessing element (602, 802, 1020) only and is accessible only through the secure accessing element (602, 802, 1020). receiving (228, 302, 322, 342, 502), by the mobile device (112, 901), a request for the mobile-based credential from a remotely accessible server (108, 950, 1104), wherein the request is received by the mobile device (112, 901) in response to a requestor device (122, 930) receiving the alias from the consumer and providing the alias to the remotely accessible server (108, 950, 1104), and the mobile-based credential being a decryption key corresponding to encrypted payment credentials; accessing (304, 350, 508), by the mobile device (112, 901), the mobile-based credential from the secure memory (902, 622, 822) by using the secure accessing element (602, 802, 1020) to certifiably request and receive the mobile-based credential from the secure store element (604, 804, 1010) over a certified communication interface (634, 834, 1030); and transmitting (234, 318, 330, 352, 510), by the mobile device (112, 901), the mobile-based credential to the remotely accessible server (108, 950, 1104), wherein the mobile-based credential is used at the remotely accessible server (108, 950, 1104) in combination with a server-based credential stored thereat for obtaining payment credentials to complete the transaction, the server-based credential being the encrypted payment credentials, and wherein the secure store element (604, 804, 1010) is exposed to the secure accessing element (602, 802, 1020) only and is accessible only through the secure accessing element (602, 802, 1020).