VERIFICATION THAT AN AUTHENTICATED USER IS IN PHYSICAL POSSESSION OF A CLIENT DEVICE

A device user being authenticated is determined to be in physical possession of the device according to data in one or more user input device buffers that indicates whether data received from a user input device is injected or is generated by physical manipulation of the user input device. If the events recorded in the buffer are not injected, the user entering the authentication data is determined to be in physical possession of the device and the user can be authenticated if the authentication data entered by the user matches predetermined reference data. Conversely, if the events are injected, the user is determined to not be in physical possession of the device and authentication fails regardless of whether the authentication data matches the predetermined reference data.