A mobile device user authentication method, comprising: receiving, by a mobile application (204; 304; 404; 504) running on a mobile device processor of a consumer mobile device, a user authentication request from an entity; transmitting, by the mobile application via an authenticator application programming interface 'API' (206; 306; 406; 506) operating in a rich execution environment 'REE' (207; 301; 403; 503) of the consumer mobile device to at least one biometric sensor of the mobile device, a biometric data capture request; determining, by the authenticator API via an access control mechanism running on the mobile device processor, that the mobile application is authorized to utilize the authenticator API; when it is determined that the mobile application is authorized to utilize the authenticator API, prompting, by the mobile device processor, the user of the consumer mobile device to provide at least one form of biometric data in accordance with predetermined business rules of the entity; performing, in a trusted execution environment 'TEE' of the consumer mobile device, an authentication process, wherein a user authentication response as a result of the authentication process is transmitted from the TEE to a trusted authentication application operating in the TEE, and wherein the TEE comprises said at least one biometric sensor; when the at least one form of biometric data provided by the user matches locally stored biometric data, validating, by the trusted authenticator application operating in the trusted execution environment 'TEE' (212; 303; 405; 505) of the consumer mobile device, the user authentication response from the at least one biometric sensor by authenticating the at least one biometric sensor; signing, by the trusted authenticator application, the validated user authentication response; transmitting, by the trusted authenticator application, the signed user authentication response to the authenticator API operating in the REE of the consumer mobile device; receiving, by the mobile application via the authenticator API, the signed user authentication response when the at least one form of biometric data provided by the user matches the locally stored biometric data; generating, by the mobile application running on the mobile device processor of the consumer mobile device, a positive user authentication response message based on the signed user authentication response; and transmitting, by the mobile application to the entity, the positive user authentication response message. receiving, by a mobile application (204; 304; 404; 504) running on a mobile device processor of a consumer mobile device, a user authentication request from an entity; transmitting, by the mobile application via an authenticator application programming interface 'API' (206; 306; 406; 506) operating in a rich execution environment 'REE' (207; 301; 403; 503) of the consumer mobile device to at least one biometric sensor of the mobile device, a biometric data capture request; determining, by the authenticator API via an access control mechanism running on the mobile device processor, that the mobile application is authorized to utilize the authenticator API; when it is determined that the mobile application is authorized to utilize the authenticator API, prompting, by the mobile device processor, the user of the consumer mobile device to provide at least one form of biometric data in accordance with predetermined business rules of the entity; performing, in a trusted execution environment 'TEE' of the consumer mobile device, an authentication process, wherein a user authentication response as a result of the authentication process is transmitted from the TEE to a trusted authentication application operating in the TEE, and wherein the TEE comprises said at least one biometric sensor; when the at least one form of biometric data provided by the user matches locally stored biometric data, validating, by the trusted authenticator application operating in the trusted execution environment 'TEE' (212; 303; 405; 505) of the consumer mobile device, the user authentication response from the at least one biometric sensor by authenticating the at least one biometric sensor; signing, by the trusted authenticator application, the validated user authentication response; transmitting, by the trusted authenticator application, the signed user authentication response to the authenticator API operating in the REE of the consumer mobile device; receiving, by the mobile application via the authenticator API, the signed user authentication response when the at least one form of biometric data provided by the user matches the locally stored biometric data; generating, by the mobile application running on the mobile device processor of the consumer mobile device, a positive user authentication response message based on the signed user authentication response; and transmitting, by the mobile application to the entity, the positive user authentication response message.