A method of authenticating a user to a transaction at a terminal, the method comprising the following steps: - a user identification is transmitted from the terminal to a transaction partner via a first communication channel, - the transaction partner forwards the user identification to an authentication device, - using a second communication channel, which involves a mobile communications network, in conjunction with a mobile device of the user for checking an authentication function, which is normally inactive and is activated by the user only preliminarily for the transaction, - as a criterion for deciding whether the authentication to the transaction shall be granted or denied, the authentication device checks whether a predetermined time relation exists between the transmission of the user identification and an active state of the authentication function, and, - if said criterion for granting the authentication is fulfilled, the authentication device sends an authentication signal to the transaction partner, characterized in that the authentication function is implemented in the mobile device of the user and permits the authentication device to detect, via the second communication channel, whether or not the authentication function is active, and in that, based on the user identification, the authentication device directly contacts the mobile device to check the active state of the authentication function and, if the authentication function is active, the authentication device receives a response from the mobile device via the second communication channel, said response including the information that the authentication function is active, and, - wherein the authentication function is automatically deactivated after a predetermined time interval after its activation and/or when its active state has been checked. - a user identification is transmitted from the terminal to a transaction partner via a first communication channel, - the transaction partner forwards the user identification to an authentication device, - using a second communication channel, which involves a mobile communications network, in conjunction with a mobile device of the user for checking an authentication function, which is normally inactive and is activated by the user only preliminarily for the transaction, - as a criterion for deciding whether the authentication to the transaction shall be granted or denied, the authentication device checks whether a predetermined time relation exists between the transmission of the user identification and an active state of the authentication function, and, - if said criterion for granting the authentication is fulfilled, the authentication device sends an authentication signal to the transaction partner, characterized in that the authentication function is implemented in the mobile device of the user and permits the authentication device to detect, via the second communication channel, whether or not the authentication function is active, and in that, based on the user identification, the authentication device directly contacts the mobile device to check the active state of the authentication function and, if the authentication function is active, the authentication device receives a response from the mobile device via the second communication channel, said response including the information that the authentication function is active, and, - wherein the authentication function is automatically deactivated after a predetermined time interval after its activation and/or when its active state has been checked.