An authentication system configured, in an enrolment phase: to exchange data with an application running on a mobile terminal via a second channel so as to receive a first terminal fingerprint of the mobile terminal from the application via the second channel; and to exchange data with a secure element comprised in the mobile terminal via a first, different channel so as to determine, via the first channel, a secure element identifier and a hardware identifier of the mobile terminal via the first channel; and wherein the authentication system is further configured, in the enrolment phase: in response to receiving, from a source, a request to enrol a user comprising a user identifier and an identifier of the mobile terminal (27, 57), to transmit a first password to the source for presentation to the user and/or to the mobile terminal; in response to receiving, from the application running on the mobile terminal, a first key, the first terminal fingerprint and a copy of the first password via the second channel, to link the user identifier, the identifier of the mobile terminal, the application and the mobile terminal, to transmit a random number to the secure element in the mobile terminal via the first channel; to send a second key to the secure element via the first channel; in response to receiving, from the secure element via the first channel, an encrypted message comprising a second terminal fingerprint encrypted with the second key, wherein the second terminal fingerprint comprises the secure element identifier and the hardware identifier, to transmit a second password, to the secure element via the first channel; and in response to receiving, from the application via the second channel, a copy of the second password and in dependence upon the copy of the second password matching the second password, to link the user identifier and the second terminal fingerprint or data included the second terminal fingerprint. to exchange data with an application running on a mobile terminal via a second channel so as to receive a first terminal fingerprint of the mobile terminal from the application via the second channel; and to exchange data with a secure element comprised in the mobile terminal via a first, different channel so as to determine, via the first channel, a secure element identifier and a hardware identifier of the mobile terminal via the first channel; and wherein the authentication system is further configured, in the enrolment phase: in response to receiving, from a source, a request to enrol a user comprising a user identifier and an identifier of the mobile terminal (27, 57), to transmit a first password to the source for presentation to the user and/or to the mobile terminal; in response to receiving, from the application running on the mobile terminal, a first key, the first terminal fingerprint and a copy of the first password via the second channel, to link the user identifier, the identifier of the mobile terminal, the application and the mobile terminal, to transmit a random number to the secure element in the mobile terminal via the first channel; to send a second key to the secure element via the first channel; in response to receiving, from the secure element via the first channel, an encrypted message comprising a second terminal fingerprint encrypted with the second key, wherein the second terminal fingerprint comprises the secure element identifier and the hardware identifier, to transmit a second password, to the secure element via the first channel; and in response to receiving, from the application via the second channel, a copy of the second password and in dependence upon the copy of the second password matching the second password, to link the user identifier and the second terminal fingerprint or data included the second terminal fingerprint. in response to receiving, from a source, a request to enrol a user comprising a user identifier and an identifier of the mobile terminal (27, 57), to transmit a first password to the source for presentation to the user and/or to the mobile terminal; in response to receiving, from the application running on the mobile terminal, a first key, the first terminal fingerprint and a copy of the first password via the second channel, to link the user identifier, the identifier of the mobile terminal, the application and the mobile terminal, to transmit a random number to the secure element in the mobile terminal via the first channel; to send a second key to the secure element via the first channel; in response to receiving, from the secure element via the first channel, an encrypted message comprising a second terminal fingerprint encrypted with the second key, wherein the second terminal fingerprint comprises the secure element identifier and the hardware identifier, to transmit a second password, to the secure element via the first channel; and in response to receiving, from the application via the second channel, a copy of the second password and in dependence upon the copy of the second password matching the second password, to link the user identifier and the second terminal fingerprint or data included the second terminal fingerprint.