# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 8 Conclusions  
Advancements in smartphone technology and mobile telecommunication networks with easy access have increased mobile money services in many developing countries. Such advancements have also introduced the financial sector to a new form of banking using technology, thus promoting and widening mobile money service coverage. However, there are many security challenges related to mobile money authentication schemes because the current systems use only PIN and SIM to authenticate mobile money users. The researchers proposed a secure and efficient multi-factor authentication algorithm for mobile money applications to address these issues. It uses PIN, OTP, and biometric fingerprints as authentication identifiers. It also involves mobile money users scanning the biometric fingerprint and secure QR code of the mobile money agents to confirm mobile money withdrawal. The security of the PIN and OTP is ensured by SHA-256, a biometric fingerprint by FIDO that uses RSA and Fernet encryption to secure QR codes and the records in the databases. Four prototypes of native G-MoMo applications were developed, i.e., G-MoMo SIM Serial Number Generator Application, G-MoMo IT Support Application, G-MoMo Agent Application, and G-MoMo Customer Application. The G-MoMo applications were developed for mobile money IT support staff, agents, and users to prove the feasibility of the proposed algorithm and provide a higher degree of security. The security analysis confirmed that the proposed algorithm offers secure and efficient authentication; ensures data confidentiality, integrity, non-repudiation, user anonymity, and privacy; and improves performance. It provides prevention to shoulder-surfing attacks, social engineering attacks, phishing attacks, PIN-guessing attacks, and brute-force attacks. Likewise, it is \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Proposed Algorithm** & \begin{tabular}{c} **Authentication** \\ **Phase** \\ \end{tabular} & \
\begin{tabular}{c} **Transaction Phase** \\ **(Cash Withdrawal)** \\ \end{tabular} &
\begin{tabular}{c} **Total** \\ **Total** \\ \end{tabular} \\ \hline
**Our Algorithm** & \(3T_{h}+1T_{Fdd}+3T_{Rde}+1T_{Fde}+1T_{Rde}+3T_{h}+2T_{Fde}+4T_{Rde}+1T_{Fde}\) \\ \hline
[93] & \(2T_{h}+1T_{ECC}\) & \(2T_{h}+3T_{ECC}\) & \(4T_{h}+4T_{ECC}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Computational cost comparison. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**S/No** & **Security Feature** & [15] & [16] & [19] & [20] & [21] & [93] & **Our Algorithm** \\ \hline
1 & Provides efficient authentication & No & Yes & No & No & No & No & Yes \\ \hline
2 & Provides data confidentiality & No & No & No & No & Yes & Yes & Yes \\ \hline
3 & Provides data integrity & No & No & No & No & Yes & No & Yes \\ \hline
4 & Ensures non-repudiation & No & No & No & No & Yes & Yes & Yes \\ \hline
5 & Ensures anonymity & No & No & No & No & No & No & Yes \\ \hline
6 & Ensures privacy & No & No & No & Yes & No & Yes \\ \hline
7 & Prevention of shoulder-surfing attacks & No & No & No & Yes & No & Yes \\ \hline
8 & Prevention of social engineering & No & No & No & No & No & Yes \\ \hline
9 & Prevention of phishing attack & No & No & Yes & No & Yes \\ \hline
10 & Prevention of PIN-guessing attack & No & No & No & Yes & No & Yes \\ \hline
11 & Prevention of brute-force attack & No & No & No & Yes & No & Yes \\ \hline
12 & Resistance to replay attacks & No & No & No & No & Yes & Yes \\ \hline
13 & Resistance to insider attacks & No & No & No & No & No & Yes \\ \hline
14 & Resistance to impersonation attacks & Yes & Yes & No & No & No & Yes \\ \hline
15 & Resistance to identity fraud & No & No & Yes & No & Yes & No \\ \hline
16 & Resistance to a MITM attack & No & No & No & Yes & No & Yes & Yes \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of the security features of the proposed algorithm with other related schemes. resistant to replay attacks, insider attacks, impersonation attacks, identity fraud, and MITM attacks.