A computer-implemented method for verifying an association between a communication device and a user to enrol an application executing on the communication device by way of which application the user transacts against a user account maintained by an entity, the method performed in a system including the communication device, a remote server and a proximity communication enabled smart card, wherein the communication device interacts with the proximity communication enabled smart card via a proximity communication interface, and wherein the remote server is maintained on behalf of the entity and has access to an enrolment database, the method comprising: installing the application on the communication device, wherein the application is provided by or on behalf of the entity; establishing a secure communication channel between the remote server and the communication device with the communication device uniquely identifiable by the remote server over the secure communication channel; receiving, at the remote server from the communication device, a device identifier and a user identifier for association with each other, the user identifier having previously been associated with the user account; using the user identifier to identify the user account associated therewith; receiving a token at the remote server from the communication device via the secure communication channel, wherein the token includes an application cryptogram obtained by the communication device, via the proximity communication interface, from the proximity communication enabled smart card of the user which generates the application cryptogram by signing a set of data elements received at the communication device from the remote server using an application cryptogram card key stored within the proximity communication enabled smart card such that at least a portion of the token has been derived from the AC card key stored within the proximity communication enabled smart card, the AC card key having previously been associated with the user in a user account and having been generated using an AC master key usable by an authorisation system associated with an issuer of the proximity communication enabled smart card to decrypt messages from the proximity communication enabled smart card; validating the received token at the remote server, including verifying the legitimacy of the application cryptogram based on information known to the remote server; once determined that the token is valid, verifying the association between the communication device and the user and storing, at the remote server, the device identifier as a verified device identifier in association with one or both of the user identifier and the user account, including creating, by the remote server in the enrolment database, a user record associated with the user account; wherein, once enrolled, the communication device and application installed thereon are usable to interact with the entity remotely, via the communication network. installing the application on the communication device, wherein the application is provided by or on behalf of the entity; establishing a secure communication channel between the remote server and the communication device with the communication device uniquely identifiable by the remote server over the secure communication channel; receiving, at the remote server from the communication device, a device identifier and a user identifier for association with each other, the user identifier having previously been associated with the user account; using the user identifier to identify the user account associated therewith; receiving a token at the remote server from the communication device via the secure communication channel, wherein the token includes an application cryptogram obtained by the communication device, via the proximity communication interface, from the proximity communication enabled smart card of the user which generates the application cryptogram by signing a set of data elements received at the communication device from the remote server using an application cryptogram card key stored within the proximity communication enabled smart card such that at least a portion of the token has been derived from the AC card key stored within the proximity communication enabled smart card, the AC card key having previously been associated with the user in a user account and having been generated using an AC master key usable by an authorisation system associated with an issuer of the proximity communication enabled smart card to decrypt messages from the proximity communication enabled smart card; validating the received token at the remote server, including verifying the legitimacy of the application cryptogram based on information known to the remote server; once determined that the token is valid, verifying the association between the communication device and the user and storing, at the remote server, the device identifier as a verified device identifier in association with one or both of the user identifier and the user account, including creating, by the remote server in the enrolment database, a user record associated with the user account; wherein, once enrolled, the communication device and application installed thereon are usable to interact with the entity remotely, via the communication network.