A system (100, 200, 300) for authenticating a software application instance, the system comprising: a user device (130, 210); a server device (120, 290, 325); and an anti-clone engine (110, 250, 310), embodied in a non-transient computer readable medium; said user device (130, 210) comprising a software application instance configured to: transmit a request for access to the server device (120, 290, 325), said request including application identification data (App ID) associated with said software application instance; said server device (120, 290, 325) being configured to: transmit session identification data (session ID) to the user device (130, 210), and transmit the session ID and the App ID to the anti-clone engine (110, 250, 310); and said anti-clone engine (110, 250, 310) being configured to: generate and transmit a challenge token to the user device (130, 210), receive a response token from said user device (130, 210), process the response token to determine whether the software application instance comprises an authentic instance of said software application, and transmit an authorization message to said server device (120, 290, 325) according to said determination, characterized in that said anti-clone engine (110, 250, 310) being further configured to: process the response token by determining a number of received response tokens, and determine that the software application instance is not authentic if an unexpected number of response tokens was received. a user device (130, 210); a server device (120, 290, 325); and an anti-clone engine (110, 250, 310), embodied in a non-transient computer readable medium; said user device (130, 210) comprising a software application instance configured to: transmit a request for access to the server device (120, 290, 325), said request including application identification data (App ID) associated with said software application instance; said server device (120, 290, 325) being configured to: transmit session identification data (session ID) to the user device (130, 210), and transmit the session ID and the App ID to the anti-clone engine (110, 250, 310); and transmit session identification data (session ID) to the user device (130, 210), and transmit the session ID and the App ID to the anti-clone engine (110, 250, 310); and said anti-clone engine (110, 250, 310) being configured to: generate and transmit a challenge token to the user device (130, 210), receive a response token from said user device (130, 210), process the response token to determine whether the software application instance comprises an authentic instance of said software application, and transmit an authorization message to said server device (120, 290, 325) according to said determination, characterized in that generate and transmit a challenge token to the user device (130, 210), receive a response token from said user device (130, 210), process the response token to determine whether the software application instance comprises an authentic instance of said software application, and transmit an authorization message to said server device (120, 290, 325) according to said determination, characterized in that said anti-clone engine (110, 250, 310) being further configured to: process the response token by determining a number of received response tokens, and determine that the software application instance is not authentic if an unexpected number of response tokens was received. process the response token by determining a number of received response tokens, and determine that the software application instance is not authentic if an unexpected number of response tokens was received.