A transaction authorisation system for allowing a customer to authorise transactions relating to at least one customer account associated with an institution, the system including: data storage means for enabling access to and storing (a) customer identification data associated with the customer; (b) device identification data associated with a remote communication device, RCD, of the customer; and (c) security identifier data which is known only to the institution and authorisation system associating the at least one customer account with (a) and (b); a first communication means for enabling communication with the customer via the RCD to authorise a transaction on the at least one customer account; a data processing architecture including data processing means to identify the customer using (a), identify the RCD using (b) and determine if the transaction is authorised by the customer; and a second communication means for receiving an authorisation request in relation to the transaction and providing an indication to the institution of whether or not the transaction is authorised by the customer, wherein the authorisation request received and the indication provided to the institution are referenced to the security identifier data, and wherein the security identifier data is not the same as, nor derived from, characteristics of or personal information relating to the customer, wherein the only identifier relating to the customer and the RCD which passes between the institution and the authorisation system is the security identifier data. data storage means for enabling access to and storing (a) customer identification data associated with the customer; (b) device identification data associated with a remote communication device, RCD, of the customer; and (c) security identifier data which is known only to the institution and authorisation system associating the at least one customer account with (a) and (b); (a) customer identification data associated with the customer; (b) device identification data associated with a remote communication device, RCD, of the customer; and (c) security identifier data which is known only to the institution and authorisation system associating the at least one customer account with (a) and (b); a first communication means for enabling communication with the customer via the RCD to authorise a transaction on the at least one customer account; a data processing architecture including data processing means to identify the customer using (a), identify the RCD using (b) and determine if the transaction is authorised by the customer; and a second communication means for receiving an authorisation request in relation to the transaction and providing an indication to the institution of whether or not the transaction is authorised by the customer, wherein the authorisation request received and the indication provided to the institution are referenced to the security identifier data, and wherein the security identifier data is not the same as, nor derived from, characteristics of or personal information relating to the customer, wherein the only identifier relating to the customer and the RCD which passes between the institution and the authorisation system is the security identifier data.