applied sciences  
A Novel Robust Geolocation-Based Multi-Factor Authentication Method for Securing ATM Payment Transactions  
[PERSON]\({}^{\text{\textregistered}}\), [PERSON],*\({}^{\text{\textregistered}}\) and [PERSON],*\({}^{\text{\textregistered}}\)  
Footnote 24: foot and the card affiliation or the association [3; 4]. According to studies [3; 4], it is evident that credit/debit card theft has evolved dramatically in recent years. In earlier times, fraudsters employed basic skimming tactics with pinhole cameras to capture the associated PIN at the ATM to harvest card credentials for card cloning [5; 6; 7; 8], whereas attack methodologies have developed over time employing a variety of approaches, such as social engineering attacks [3; 4]. Thus, in order to prevent the compromise of electronic payments that are being made, banks/financial institutions have introduced novel ways of authenticating users when they are executing ATM transactions [7; 8; 9]. These include both single-factor and multi-factor authentication methods such as username and password, OTP, and PIN. However, most of these methods are no longer secure and open the cardholder to risk where user credentials can be captured through interception and person-in-the-middle attacks for gaining access to the user account, especially when dealing with payment gateway mobile apps and web platforms, as PINs can be captured with card details for cloning the card. Thus, single-factor authentication is no longer deemed sufficient for user authentication and is regarded as insecure for high-risk financial transactions. This has resulted in the usage of multi-factor authentication to safeguard payment transactions and boost user confidence in making such payment transactions, which at times appears to be insufficient due to PIN harvesting and card cloning security attacks [10; 11; 12; 13; 14]. While existing electronic transaction systems provide a certain level of authentication via means such as OTPs and PINs, the underlying process leaves the current systems (banking infrastructure) in a vulnerable state, making these PINs and OTPs vulnerable [3; 4; 5; 6; 7; 15; 16; 17; 18; 19; 20]; therefore, it leaves a research gap that needs our thorough attention. To address this in the study, we are proposing a novel solution that would allow users to authenticate every ATM transaction via a unique smartphone app by measuring the real-time geolocation of the user when authenticating payment transactions. Overall, geolocation can be used as an authentication factor because it confirms a user's physical presence at a specific location, adding an extra layer of security. It helps prevent unauthorized access, works well with other factors like passwords or biometrics, and adapts to changing user behaviors. On the other hand, while geolocation offers such benefits, it is best when combined with other factors to create a more robust and more reliable authentication process. In existing systems, one of the main concerns is that they are keeping track of the user's location on a regular basis and using vulnerable authentication mechanisms such as OTPs [5; 6]. In addition, the high operating costs also prevent certain existing security mechanisms from being implemented (e.g., biometrics), endangering the ATM payment ecosystem. In our proposed solution, we have considered all these pertinent issues, and our proposed authenticator app will only require the user's location when it is deemed necessary, where location data will only be needed when a payment transaction needs to be authenticated. Thus, the use of the app also eliminates less secure mechanisms such as OTPs. The user would receive a push notification for each transaction based on the geolocation. Only approved transactions via the app would be valid, whereas any transactions that are not approved will be void. As per our proposed solution, our smart mobile app will be available across major app store platforms, which provides accessibility to a larger audience.