SECURE CAPTURE OF A DATA ITEM AT A CLIENT DEVICE

An obfuscated code package is deployed to a client device to effect secure capture of a data item at the client device. The data item may be biometric authorisation data such as a facial image. It may also be data captured from a physical document. The obfuscated code package has a cryptographic key embedded in it or derivable from it. The key may have an expiration time. When executed on the client, the code package captures the data item, generates a secure signed message using the cryptographic key. The message includes the data item. Different versions of the code package may be deployed with different forms of obfuscation, different cryptographic keys, different cryptographic algorithms or different key derivation algorithms. The code may include a randomised challenge. The code package may be deployed by a server. The code package may run in a Web browser or other application. The server may validate the message.