A computer-implemented authentication method, comprising: receiving, by an authentication server from a data processing device performing authentication of a user, a credential request message comprising a first authentication credential; validating, by the authentication server, the first authentication credential; wherein, in the event the validating is successful, the method further comprises: generating, by the authentication server, a second authentication credential; linking, by the authentication server, the second authentication credential to the first authentication credential; transmitting, by the authentication server, the second authentication credential to the data processing device; and de-authorising, by the authentication server, the first authentication credential, the method further comprising, before the receiving the credential request message: receiving, by the authentication server as part of a first authentication attempt by the user, a first authentication request message comprising the first authentication credential; and validating, by the authentication server, the first authentication credential, the method further comprising: receiving, by the authentication server as part of a subsequent authentication attempt by the user, a subsequent authentication request message comprising the second authentication credential; and validating, by the authentication server, the second authentication credential, wherein the subsequent authentication request message further comprises a flag indicating that the authentication attempt is a subsequent authentication attempt. receiving, by an authentication server from a data processing device performing authentication of a user, a credential request message comprising a first authentication credential; validating, by the authentication server, the first authentication credential; wherein, in the event the validating is successful, the method further comprises: generating, by the authentication server, a second authentication credential; linking, by the authentication server, the second authentication credential to the first authentication credential; transmitting, by the authentication server, the second authentication credential to the data processing device; and de-authorising, by the authentication server, the first authentication credential, generating, by the authentication server, a second authentication credential; linking, by the authentication server, the second authentication credential to the first authentication credential; transmitting, by the authentication server, the second authentication credential to the data processing device; and de-authorising, by the authentication server, the first authentication credential, the method further comprising, before the receiving the credential request message: receiving, by the authentication server as part of a first authentication attempt by the user, a first authentication request message comprising the first authentication credential; and validating, by the authentication server, the first authentication credential, receiving, by the authentication server as part of a first authentication attempt by the user, a first authentication request message comprising the first authentication credential; and validating, by the authentication server, the first authentication credential, the method further comprising: receiving, by the authentication server as part of a subsequent authentication attempt by the user, a subsequent authentication request message comprising the second authentication credential; and validating, by the authentication server, the second authentication credential, wherein the subsequent authentication request message further comprises a flag indicating that the authentication attempt is a subsequent authentication attempt. receiving, by the authentication server as part of a subsequent authentication attempt by the user, a subsequent authentication request message comprising the second authentication credential; and validating, by the authentication server, the second authentication credential, wherein the subsequent authentication request message further comprises a flag indicating that the authentication attempt is a subsequent authentication attempt.