A method and system of authenticating submissions from a client to a server within a secure session as established for example by entry of username and password data, wherein the session is composed of a number of transactions each of which is itself additionally authenticated, for example by submission of biometric data. Thus each transaction is authenticated both individually and at a session level. In an embodiment the session level authentication may comprise submission of a pin code at am ATM, whilst every subsequent request or instruction from the user could be accompanied by for example fingerprint data from a scanner integrated in the ATM keypad. A session comprises a number of transactions, each of which is individually authenticated. Preferably a session level authentication is carried out at the beginning of a session, from which authority for the following transaction authentications is derived. This may be achieved by comparing transaction authentication information with the authorised session initiating authentication data. Each transaction can be provided with authentication data by recourse to biometric measurements of a user.