Active behavioural-based authentication systems are challenge-response based implicit authentication systems that authenticate users using the behavioural features of the users when responding to challenges that are sent from the server. They provide a flexible (no extra hardware) and secure second factor for authentication systems, with applications including protection against identity theft and password compromise of web applications. We propose a novel active behavioural authentication system for mobile devices, called DAC (Draw A Circle), where a challenge specifies a set of constraints on a circle and the response is a user drawn circle that satisfies the constraints. We carefully select a set of features that capture behavioural traits of the user which is used to construct a profile for them, then design a matching algorithm that allows users to be authenticated with approximately 95% accuracy. We discuss our implementation, and present our experimental results that show, (i) the accuracy of authentication system and (ii) non-delegateability of profile, guaranteeing that the user cannot pass their credentials to others.