A computer-implemented method conducted at a server computer of an authentication service provider at the time of a financial transaction, comprising: receiving an authentication request, the authentication request requesting authentication of the financial transaction and including transaction details describing the financial transaction; obtaining an encryption key being unique to the authentication service provider and a user mobile device; generating an authentication prompt including at least some of the transaction details included in the authentication request; encrypting a payload including a nonce and the authentication prompt using the encryption key to output an encrypted payload; providing the encrypted payload via a first communication channel to a user for acquisition and decryption by the user mobile device using a decryption key corresponding to the encryption key for the user mobile device to obtain the nonce, to display the authentication prompt including the at least some of the transaction details, and provide a token based on or including one or both of the at least some of the transaction details or the nonce for submission to the authentication service provider; receiving a validation request including the token; validating the token; and, if the token is valid, transmitting an authentication confirmation message confirming authentication of the financial transaction; wherein obtaining the encryption key includes accessing a mobile device public key stored at the authentication service provider and being uniquely associated with a mobile device private key securely stored in the user mobile device. wherein obtaining the encryption key includes: obtaining a symmetric key; accessing the mobile device public key and an authentication service provider private key being securely stored at the authentication service provider and being uniquely associated with an authentication service provider public key accessible to the mobile device, wherein encrypting the payload includes: encrypting the payload using the symmetric key to output a symmetrically encrypted payload; and asymmetrically encrypting the symmetric key using one or both of the mobile device public key and the authentication service provider private key to output an asymmetrically encrypted symmetric key, and wherein the encrypted payload includes the symmetrically encrypted payload and the asymmetrically encrypted symmetric key. receiving an authentication request, the authentication request requesting authentication of the financial transaction and including transaction details describing the financial transaction; obtaining an encryption key being unique to the authentication service provider and a user mobile device; generating an authentication prompt including at least some of the transaction details included in the authentication request; encrypting a payload including a nonce and the authentication prompt using the encryption key to output an encrypted payload; providing the encrypted payload via a first communication channel to a user for acquisition and decryption by the user mobile device using a decryption key corresponding to the encryption key for the user mobile device to obtain the nonce, to display the authentication prompt including the at least some of the transaction details, and provide a token based on or including one or both of the at least some of the transaction details or the nonce for submission to the authentication service provider; receiving a validation request including the token; validating the token; and, if the token is valid, transmitting an authentication confirmation message confirming authentication of the financial transaction; wherein obtaining the encryption key includes accessing a mobile device public key stored at the authentication service provider and being uniquely associated with a mobile device private key securely stored in the user mobile device. wherein obtaining the encryption key includes: obtaining a symmetric key; accessing the mobile device public key and an authentication service provider private key being securely stored at the authentication service provider and being uniquely associated with an authentication service provider public key accessible to the mobile device, obtaining a symmetric key; accessing the mobile device public key and an authentication service provider private key being securely stored at the authentication service provider and being uniquely associated with an authentication service provider public key accessible to the mobile device, wherein encrypting the payload includes: encrypting the payload using the symmetric key to output a symmetrically encrypted payload; and asymmetrically encrypting the symmetric key using one or both of the mobile device public key and the authentication service provider private key to output an asymmetrically encrypted symmetric key, and encrypting the payload using the symmetric key to output a symmetrically encrypted payload; and asymmetrically encrypting the symmetric key using one or both of the mobile device public key and the authentication service provider private key to output an asymmetrically encrypted symmetric key, and wherein the encrypted payload includes the symmetrically encrypted payload and the asymmetrically encrypted symmetric key.