# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 5 Security Analysis
In addition, the use of a secure QR code to store an encrypted mobile money agent code helps to ensure privacy [74]. Prevention of shoulder-surfing attacks: The current 2 FA for mobile money uses only PIN and SIM to authenticate users, which is insufficient to provide strong security. Therefore, this approach is vulnerable to shoulder-surfing attacks because the PINs are entered when they are unmasked. However, using multiple identifiers, such as PIN, OTP, biometric fingerprint, and a secure QR code, in the proposed algorithm helps to prevent shoulder-surfing attacks [13; 20; 46]. Prevention of social engineering attacks: Social engineering is a typical security challenge in mobile money where attackers persuade mobile money agents and usersby calling them to reveal their mobile money PINs. This security challenge is solved in the proposed algorithm by implementing multi-factor authentication where users have to avail multiple identifiers such as PIN, OTP, and biometric fingerprint to verify them. Even if the attackers obtain the PIN, it will not be easy to guess the next OTP since it is generated randomly and only valid for 60 s. It is also challenging to get the biometric fingerprints because it is secured using FIDO, where public/private key pairs are generated. The private key and biometric templates are kept in the user's smartphone and the public key in the FIDO database. * Prevention of phishing attack: A phishing attack is where adversaries disguise themselves as the staff of the mobile money service provider by sending messages or voice calls to mobile money agents and users requesting them to avail their mobile money PINs. Once they succeed in obtaining the user's PIN, they can perform fraudulent transactions. The proposed algorithm solves this problem by implementing multi-factor authentication using a PIN, OTP, and biometric fingerprint. The OTP is random and unique and only valid for 60 s. The biometric fingerprint is secured using FIDO that uses RSA to generate public/private key pairs. The generated public key is encrypted and sent to the online FIDO database associated with the user's mobile money account and saved in a Keystore. The private key and biometric templates are encrypted and stored in the smartphone's cryptographic Keystore and smartphone [20; 62; 68; 69; 70; 71]. Moreover, integrating a secure QR code in mobile money agent authorization helps prevent phishing attacks [77]. * Prevention of PIN-guessing attack: The current 2 FA scheme for mobile money uses four- or five-digit PINs to authenticate users, making it easy for the attacker to guess because of their simplicity. This attack is mitigated in the proposed algorithm using additional authentication factors such as OTP and biometric fingerprint. The OTP sent to users is four digits and is randomly generated, making it difficult for the attacker to guess the next OTP. Besides, the OTP is hashed using SHA-256 and encrypted using Fernet before saving it in the database. Furthermore, biometric fingerprints are secured using FIDO that uses RSA, making it complicated for the adversaries to guess the public and private keys used. The biometric template is encrypted and stored in the user's smartphone [20]. * Prevention of brute-force attack: Attackers are familiar with PIN-based authentication systems, and most of the PINs used are easy to crack. Therefore, even if the PIN and OTP are cracked, it becomes difficult to break the FIDO system because it uses RSA to encrypt public/private key pairs and biometric templates. The encrypted private key and biometric template are stored in the user's smartphone, and the encrypted public key is stored in the FIDO database. Similarly, the secure QR code to store the encrypted mobile money agent code that the customer scans to confirm mobile money withdrawal helps prevent brute-force attacks [20; 46].