## 2 Literature Review and Related Work
However, this method is susceptible to a variety of risks, including loss, illegal access, forgetfulness, etc. [39; 40; 41; 42]. On the other hand, many individuals, in spite of the many warnings that are sent to card users regarding the risk associated with usage, continue to choose passwords and PINs that are easy to guess, such as their social security number, birthday, etc. However, because of the constraints of this design, an intruder who obtains a user's card and then attempts to guess the user's PIN or predicts the user's password may do so successfully, which is known as a brute-force attack. In spite of all of the security precautions that have been put into place, there are still instances of criminal activity involving ATMs all over the world. As the use of ATMs continues to grow, ensuring robust authentication methods becomes paramount in preventing these fraudulent activities and protecting user data. Starting from single-factor authentication, authentication technology has evolved to the level of multi-factor authentication. The most straightforward way of authentication is known as single-factor authentication, where an individual may authenticate their identity by matching only one credential (e.g., providing a password for a username/providing a PIN for an ATM). MFA, also known as Two-Factor Authentication or Two-Step Verification, is a security process that requires users to provide two or more different forms of identification or credentials to verify their identity before gaining access to a system, application, or service. The primary goal of MFA is to add an extra layer of security beyond traditional username-password combinations, making it more difficult for unauthorized individuals to access sensitive information or perform malicious activities. The three typical factors used in MFA are:  
1. Knowledge factor (something you know) This factor involves information that only the authorized user should know, such as a password, PIN, or a specific answer to a security question [10; 11]. 2. Possession factor (something you have) This factor involves possessing a physical device or object that uniquely belongs to the user, such as a smartphone, smart card, hardware token, or an OTP generator [10; 11]. 3. Inherence factor (something you are) This factor refers to biometric characteristics unique to each individual, such as fingerprints, facial recognition, iris patterns, voice recognition, or even behavioral biometrics (e.g., keystroke dynamics) [10; 11]. To authenticate using MFA, a user needs to provide at least two of these factors. For example, after entering their username and password (something they know), the user may be prompted to enter a one-time code generated on their smartphone (something they have) or use their fingerprint on a biometric scanner (something they are) [5; 10; 11]. The main advantages of MFA include enhanced security by combining multiple factors and significantly reducing the risk of unauthorized access, even if one factor is compromised [5; 10; 11]. Other key advantages of MFA include: 1. Protection against password attacks MFA provides an additional layer of protection against common password-based attacks like brute-force and phishing [14; 15; 16]. 2. Compliance requirements Many industry regulations and security standards, such as PCI DSS and GDPR, require or strongly recommend the use of MFA to protect sensitive data [16; 17; 18; 19; 20]. 3. User-friendly MFA can be implemented in a user-friendly manner, often through smartphones and apps, without causing significant inconvenience to users [14; 15; 16]. Overall, MFA is an essential security mechanism that adds an extra layer of protection to ensure the identity of users attempting to access sensitive information, systems, or services. It has become increasingly prevalent across various applications and industries as a crucial defense against cyber threats [17; 18; 19; 20]. Further, the landscape of payment security is constantly evolving, and new methods are being introduced occasionally [21; 22; 23; 24; 25].