# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
###### Abstract  
With the expansion of smartphone and financial technologies (FinTech), mobile money emerged to improve financial inclusion in many developing nations. The majority of the mobile money schemes used in these nations implement two-factor authentication (2 FA) as the only means of verifying mobile money users. These 2 FA schemes are vulnerable to numerous security attacks because they only use a personal identification number (PIN) and subscriber identity module (SIM). This study aims to develop a secure and efficient multi-factor authentication algorithm for mobile money applications. It uses a novel approach combining PIN, a one-time password (OTP), and a biometric fingerprint to enforce extra security during mobile money authentication. It also uses a biometric fingerprint and quick response (QR) code to confirm mobile money withdrawal. The security of the PIN and OTP is enforced by using secure hashing algorithm-256 (SHA-256), a biometric fingerprint by Fast IDentity Online (FIDO) that uses a standard public key cryptography technique (RSA), and Femet encryption to secure a QR code and the records in the databases. The evolutionary prototyping model was adopted when developing the native mobile money application prototypes to prove that the algorithm is feasible and provides a higher degree of security. The developed applications were tested, and a detailed security analysis was conducted. The results show that the proposed algorithm is secure, efficient, and highly effective against the various threat models. It also offers secure and efficient authentication and ensures data confidentiality, integrity, non-repudiation, user anonymity, and privacy. The performance analysis indicates that it achieves better overall performance compared with the existing mobile money systems. mobile money systems; 2 FA; multi-factor authentication; PIN; OTP; biometric fingerprint; Twilio SMS; QR code; SHA-256; FIDO; Femet encryption; mobile money +
Footnote †: journal:  
Mobile money as a FinTech has been beneficial to subscribers, from a comfortable way of sending and receiving the money to improving the standard of living of the unbanked people [8; 9; 10]. Today, most mobile money systems authenticate their subscribers using a PIN and SIM. This 2 FA scheme, though promising, is weak, thus increasing the number of security challenges [8; 9; 11] due to the short PIN length (4 or 5 digits) used, the same PIN being used to authenticate all mobile money services, the fact that there is no expiry date for the PIN, the fact that sharing the PIN among users takes place and the fact that the PIN is entered when unmasked during verification [12; 13]. The rapid adoption of smartphones that comes with in-built biometric fingerprint sensors can enhance mobile money authentication. This study aims to develop a secure and efficient multi-factor authentication algorithm for mobile money applications where subscribers will be authenticated using a PIN, OTP, and biometric fingerprint. It also uses a fingerprint and QR code to confirm money withdrawal. Since mobile money systems contain confidential financial information, they must be protected from unauthorized users. Deploying a highly secure and efficient multi-factor authentication scheme will secure the mobile money systems' authentication and sensitive financial records. There are related studies that focus on multi-factor authentication schemes for mobile money. For example, [PERSON] [14] presented a framework that uses PIN and iris biometric to improve the security of mobile money services. [PERSON] et al. [15] proposed a secure mobile money transfer system that uses PIN and iris biometric for Bangladesh's small and medium enterprises (SMEs). [PERSON] [16] proposed a multi-factor authentication scheme for mobile phones that uses device-specific ID, voice biometric, and PIN to secure M-PESA transactions. However, the existing proposed algorithms, though promising, are vulnerable to several security attacks.