Methods and systems for authenticating a user are described. In some embodiments, a one-time token and a recording of the one-time token is read aloud by the user. The voice characteristics derived from the recording of the one-time token are compared with voice characteristics derived from samples of the user's voice. The user may be authenticated when the one-time token is verified and when a match of the voice characteristics derived from the recording of the one-time token and the voice characteristics derived from the samples of the user's voice meet or exceed a threshold.