A method comprising: receiving (802; 902), by a server computer from a requesting device, a request for access to a resource to a user device, the request comprising access data; transmitting , by the server computer to an authentication computer, an authentication request message comprising at least a subset of the access data; and receiving , by the server computer from the authentication computer, an authentication response message comprising authentication data, wherein the authentication computer generated the authentication data based on at least a subset of the access data, and wherein the authentication data comprises an authentication code indicating an authentication result and an authentication cryptogram; determining (804; 910), by the server computer, an access score based on the access data and at least a subset of the authentication data; comparing (806; 912), by the server computer, the access score to one or more threshold values to determine whether to transmit an authorization request message to an authorization computer, and, if the access score meets or exceeds the threshold: generating , by the server computer, an access indicator based on the access score; preparing , by the server computer, the authorization request message comprising the access indicator, the authentication code, and the authentication cryptogram; and transmitting , by the server computer to the authorization computer, the authorization request message, wherein the authorization computer approves or declines the access to the resource to the user device based on the access indicator and the authentication data comprised in the authorization request message. receiving (802; 902), by a server computer from a requesting device, a request for access to a resource to a user device, the request comprising access data; transmitting , by the server computer to an authentication computer, an authentication request message comprising at least a subset of the access data; and receiving , by the server computer from the authentication computer, an authentication response message comprising authentication data, wherein the authentication computer generated the authentication data based on at least a subset of the access data, and wherein the authentication data comprises an authentication code indicating an authentication result and an authentication cryptogram; determining (804; 910), by the server computer, an access score based on the access data and at least a subset of the authentication data; comparing (806; 912), by the server computer, the access score to one or more threshold values to determine whether to transmit an authorization request message to an authorization computer, and, if the access score meets or exceeds the threshold: generating , by the server computer, an access indicator based on the access score; preparing , by the server computer, the authorization request message comprising the access indicator, the authentication code, and the authentication cryptogram; and transmitting , by the server computer to the authorization computer, the authorization request message, wherein the authorization computer approves or declines the access to the resource to the user device based on the access indicator and the authentication data comprised in the authorization request message. generating , by the server computer, an access indicator based on the access score; preparing , by the server computer, the authorization request message comprising the access indicator, the authentication code, and the authentication cryptogram; and transmitting , by the server computer to the authorization computer, the authorization request message, wherein the authorization computer approves or declines the access to the resource to the user device based on the access indicator and the authentication data comprised in the authorization request message. <EOS>