A method (500, 600) for provisioning access data to an untrusted second application on a mobile device by using a trusted first application on the mobile device, comprising: receiving, by the mobile device, user authentication data at the trusted first application on the mobile device, wherein the user authentication data are used to authenticate the user of the mobile device; transmitting, by the mobile device, the user authentication data to an authorization computer system, wherein the authorization computer system validates the transmitted authentication data, and in the case of correct validation of the authentication data, then generates an authentication code, and then transmits the authentication code to a validation entity computer; then receiving, by the mobile device, from the authorization computer system, the authentication code via the trusted first application, wherein the authentication code is derived from the access data; and wherein the access data corresponds to data which the user of the mobile device may use to access a resource or a location; then providing, by the mobile device, the authentication code from the trusted first application to the untrusted second application on the mobile device; then, providing, by the untrusted second application on the mobile device, the authentication code to the validation entity computer, wherein the validation entity computer verifies the provided authentication code and in case of correct verification of the provided authentication code, then obtains the access data from the authentication code; and receiving, upon said correct verification, by the untrusted second application on the mobile device from a provisioning server computer in communication with the validation entity computer, the access data, wherein the authentication code comprises a first portion comprising encrypted information and a second portion comprising unencrypted information, the unencrypted information containing information on how to process the encrypted information, so that the validity of the authentication code can be verified. receiving, by the mobile device, user authentication data at the trusted first application on the mobile device, wherein the user authentication data are used to authenticate the user of the mobile device; transmitting, by the mobile device, the user authentication data to an authorization computer system, wherein the authorization computer system validates the transmitted authentication data, and in the case of correct validation of the authentication data, then generates an authentication code, and then transmits the authentication code to a validation entity computer; then receiving, by the mobile device, from the authorization computer system, the authentication code via the trusted first application, wherein the authentication code is derived from the access data; and wherein the access data corresponds to data which the user of the mobile device may use to access a resource or a location; then providing, by the mobile device, the authentication code from the trusted first application to the untrusted second application on the mobile device; then, providing, by the untrusted second application on the mobile device, the authentication code to the validation entity computer, wherein the validation entity computer verifies the provided authentication code and in case of correct verification of the provided authentication code, then obtains the access data from the authentication code; and receiving, upon said correct verification, by the untrusted second application on the mobile device from a provisioning server computer in communication with the validation entity computer, the access data, wherein the authentication code comprises a first portion comprising encrypted information and a second portion comprising unencrypted information, the unencrypted information containing information on how to process the encrypted information, so that the validity of the authentication code can be verified.