A method of providing authenticated access to a secure resource of a self-service terminal (120 or 400), the method comprising: generating, by a control application of the self-service terminal (120 or 400), in response to receiving a request for access to the secure resource sent from a mobile device, an authentication token (step 211 or step 213 or step 214); providing, by the control application, the authentication token (step 210) comprising presenting the authentication token on a display of the self-service terminal (120 or 400); a mobile application of the mobile device scanning the authentication token and contacting an authentication server over a wireless connection; the authentication server independently authenticating the mobile device using the generated authentication token; once the mobile device has been authenticated by the authentication server, the method being further characterized by the authentication server instructing a controller server to send an access command to the control application of the self-service terminal (120 or 400); obtaining, by the control application, the access command from the controller server (step 220); requesting, by the control application, a cryptographic peripheral device to validate the access command (step 230); the cryptographic peripheral device, in response to the request to validate the access command, sending a challenge message to the controller server; the controller server digitally signing and sending the challenge message back to the cryptographic peripheral device as a response; the cryptographic peripheral device validating the response, and providing authenticated access to the secure resource of the self-service terminal (120 or 400) upon verification by the cryptographic peripheral device that the response was a valid response to the challenge message (step 230). generating, by a control application of the self-service terminal (120 or 400), in response to receiving a request for access to the secure resource sent from a mobile device, an authentication token (step 211 or step 213 or step 214); providing, by the control application, the authentication token (step 210) comprising presenting the authentication token on a display of the self-service terminal (120 or 400); a mobile application of the mobile device scanning the authentication token and contacting an authentication server over a wireless connection; the authentication server independently authenticating the mobile device using the generated authentication token; once the mobile device has been authenticated by the authentication server, the method being further characterized by the authentication server instructing a controller server to send an access command to the control application of the self-service terminal (120 or 400); obtaining, by the control application, the access command from the controller server (step 220); requesting, by the control application, a cryptographic peripheral device to validate the access command (step 230); the cryptographic peripheral device, in response to the request to validate the access command, sending a challenge message to the controller server; the controller server digitally signing and sending the challenge message back to the cryptographic peripheral device as a response; the cryptographic peripheral device validating the response, and providing authenticated access to the secure resource of the self-service terminal (120 or 400) upon verification by the cryptographic peripheral device that the response was a valid response to the challenge message (step 230).