Method for authenticating a user of a mobile communications device, the method comprising the following steps: a) the mobile communications device making a first electromagnetic, EM, field measurement, and going to step b); b) the mobile communications device making a second electromagnetic field measurement after a passive and portable magnetic token associated to said user has been placed by the user in a pre-established first position, and going to step c); c) the mobile communications device making at least a third electromagnetic field measurement after the magnetic token has been placed by the user in at least a pre-established second position, and going to step d); d) determining from the measurements made, an EM signature of the magnetic token and at least one EM signature of the modification of the magnetic token position, and going to step e) e) depending on which authentication factors are required to perform the authentication, transmitting to a server one or more of the following: the first electromagnetic field measurement, the EM signature of the magnetic token, the at least one EM signature of the modification of the magnetic token position; and then going to step f); f) in the server, depending on which authentication factors are required to perform the authentication, verifying one or more of the following: whether the determined EM signature of the magentic token is authorized by comparing the determined EM signature of the magnetic token with a stored authorized EM signature of the magentic token; whether the at least one determined EM signature of the modification of the magentic token position is authorized by comparing the at least one determined EM signature of the modification of the magnetic toker position with at least one stored authorized EM signature of the modification of the magnetic token position; whether a shift in the mobile communications device location, obtained from the first electromagnetic field measurement made, is within an authorized range; g) if any of the verifications performed in step f) is negative, considering the authentication unsuccessful and the server sending an unsuccessful authentication message to the mobile communications device, otherwise the server sending a successful authentication message to the mobile communications device. a) the mobile communications device making a first electromagnetic, EM, field measurement, and going to step b); b) the mobile communications device making a second electromagnetic field measurement after a passive and portable magnetic token associated to said user has been placed by the user in a pre-established first position, and going to step c); c) the mobile communications device making at least a third electromagnetic field measurement after the magnetic token has been placed by the user in at least a pre-established second position, and going to step d); d) determining from the measurements made, an EM signature of the magnetic token and at least one EM signature of the modification of the magnetic token position, and going to step e) e) depending on which authentication factors are required to perform the authentication, transmitting to a server one or more of the following: the first electromagnetic field measurement, the EM signature of the magnetic token, the at least one EM signature of the modification of the magnetic token position; and then going to step f); f) in the server, depending on which authentication factors are required to perform the authentication, verifying one or more of the following: whether the determined EM signature of the magentic token is authorized by comparing the determined EM signature of the magnetic token with a stored authorized EM signature of the magentic token; whether the at least one determined EM signature of the modification of the magentic token position is authorized by comparing the at least one determined EM signature of the modification of the magnetic toker position with at least one stored authorized EM signature of the modification of the magnetic token position; whether a shift in the mobile communications device location, obtained from the first electromagnetic field measurement made, is within an authorized range; g) if any of the verifications performed in step f) is negative, considering the authentication unsuccessful and the server sending an unsuccessful authentication message to the mobile communications device, otherwise the server sending a successful authentication message to the mobile communications device.