A method for authenticating a user when logging in at an online service, where the online service is provided by a server arrangement and the method is based on a communication between the online service and a primary device and between the online service and a secondary device, the method comprising the following steps: a) a user identification specified by the user at the secondary device and not including any credential is received by the online service; b) an authentication request is transmitted by the online service to the primary device where the primary device is associated with the user identification; c) an authentication response comprising at least one credential is transmitted by the primary device to the online service, where the at least one credential originates from a storage in the primary device and is only transmitted through the authentication response upon a successful local authentication of the user at the primary device or where the at least one credential is specified by the user at the primary device; d) in case of a successful verification of the at least one credential by the online service, the user is logged in at the online service and a confirmation of the login is sent to the secondary device, characterized in that a verification code is transmitted to the primary device and stored therein, where the verification code is also stored in the secondary device, wherein - the verification code stored in the primary device is output at a user interface of the primary device and a user interface of the secondary device enables a user to input the verification code output at the user interface of the primary device for a check by the secondary device whether the verification code input at the user interface of the secondary device coincides with the verification code stored in the secondary device; or - the verification code stored in the secondary device is output at a user interface of the secondary device and a user interface of the primary device enables a user to input the verification code output at the user interface of the secondary device for a check by the primary device whether the verification code input at the user interface of the primary device coincides with the verification code stored in the primary device. a) a user identification specified by the user at the secondary device and not including any credential is received by the online service; b) an authentication request is transmitted by the online service to the primary device where the primary device is associated with the user identification; c) an authentication response comprising at least one credential is transmitted by the primary device to the online service, where the at least one credential originates from a storage in the primary device and is only transmitted through the authentication response upon a successful local authentication of the user at the primary device or where the at least one credential is specified by the user at the primary device; d) in case of a successful verification of the at least one credential by the online service, the user is logged in at the online service and a confirmation of the login is sent to the secondary device, - the verification code stored in the primary device is output at a user interface of the primary device and a user interface of the secondary device enables a user to input the verification code output at the user interface of the primary device for a check by the secondary device whether the verification code input at the user interface of the secondary device coincides with the verification code stored in the secondary device; - the verification code stored in the secondary device is output at a user interface of the secondary device and a user interface of the primary device enables a user to input the verification code output at the user interface of the secondary device for a check by the primary device whether the verification code input at the user interface of the primary device coincides with the verification code stored in the primary device.