## 5 Results and Discussion
#### Analysis of Security Testing  
During the phase of black-box testing, a security analysis was conducted to ensure that the proposed solution could withstand most of the common cyberattacks that target the payment ecosystem, as discussed in the following. * Ensures data confidentiality and integrity As per the prototype development, we employed the Google Firebase database to store confidential user information and transaction information, which are protected by Firebase's security standards. The data stored on Firebase were encrypted with the AES-256 algorithm, and each encryption key was also encrypted with a regularly rotated set of master keys, providing better security over stored data. On the other hand, all the communication links were secured using the HTTPS protocol, making sure that the data sent between the user and the server could not be tampered with during transmission, guaranteeing confidentiality and data integrity. * Provides robust authentication \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Transaction** & **Available** & **Withdraw** & **Request** & **Multi-Factor** & **Payment** & **Authentication** \\
**ID** & **Balance (USD)** & **Limit (USD)** & **Amount (USD)** & **Authentication ON/OFF** & **Status** & **Time Using the App** \\ \hline
1 & 200 & 2000 & 100 & ON & Success & 4.2 s \\ \hline
2 & 300 & 2000 & 400 & ON & Failed & 4.1 s \\ \hline  
\hline \end{tabular}
\end{table} 
Table 3: Transaction results. The proposed multi-factor authentication in the study used a PIN, the user's smart mobile device, and the location of the device as the authentication factors. As all modern smartphones are equipped with GPS location services, the proposed method allowed users to authenticate in a convenient and more secure way, as once the user activated the multi-factor authentication from the mobile app, the transactions were authenticated, matching the user's GPS location with the ATM location. * Ensure user privacy. All the database records and the data that communicate over the entire ecosystem were encrypted, thus protecting the user and the data privacy. * Protection against theft or loss In the case of theft or loss of the card, the authenticator app enabled users to block the card at any time, allowing them to protect their bank accounts. Table 4 provides a brief comparison of the security functionalities of our proposed solution with the existing work (\(\blackcheck\blackcheck\blackcheck\blackcheck\blackcheck\))-yes, \(\blackcheck\blackcheck\blackcheck\)-no). Overall, it was evident that the implemented system was working well without any bugs and offering the intended functionality. Overall, it proved that our solution could be easily implemented without making major modifications to the existing banking infrastructure and offered convenient facilities to the users, such as allowing them to deactivate/reactivate authentication at any time, block the card in case it is stolen or lost, and set up a withdrawal limit. Moreover, in terms of the security testing carried out, it was proved that our proposed solution withstood/prevented most of the cyberattacks and provided protection when the card was lost or stolen, which was not addressed by any of the research that we reviewed. Further, our solution can also be extended to secure POS transactions, as most POS transactions do not involve any authentication, which leads to various cyberattacks. As no major modification is needed, the proposed solution can be easily integrated with authenticating POS transactions. To obtain the exact user location via mobile, we relied on the Google Maps API, which employs a combination of GPS, cell tower triangulation, and various data sources. While