# Two-Factor Authentication Scheme for Mobile Money: A Review of Threat Models and Countermeasures
## 2 Related Work
### Countermeasures
#### 2.8.2 Personal Identification  
The personal identification is further categorised into number-based countermeasures and biometric-based countermeasures. 1. Number-Based Countermeasures: The examples of number-based countermeasures used in mobile money authentication include password, PIN, OTP, and QR code. * Password: A password is a string of characters including letters, digits, or symbols that a user memorises secretly to confirm their identity. An authentication party verifies the identity of a person to access a service. It is a requirement that the password should be long (at least eight characters), a mixture of both uppercase and lowercase letters, as well as letters and numbers, and should include special characters. Similarly, a password must be changed frequently and easy to remember, but a nondictionary word so that it is hard for an attacker to guess. In most cases, the password is used alongside a username during authentication. Authentication schemes in [79; 80; 81] used a password to enhance the security of mobile money. The scheme in [80] integrated username and password, phone number, and voice biometric solutions during the authentication of M-Pesa transactions. The scheme in [81] employed username, password, and fingerprint in mobile banking transaction. The password remains the weakest component of many authentication systems [82]. * PIN: [PERSON], [PERSON], and [PERSON] [83] defined a PIN as a numeric key used for authenticating users in an electronic transaction. For user convenience, PINs are often short (up to eight digits) to allow access to only authorised users. PINs are widely used for user authentication such as withdrawing cash from mobile money or withdrawing money from an automated teller machine (ATM) [84]. [PERSON] [52], [PERSON] [85], [PERSON] [86],[PERSON] and [PERSON] [87], [PERSON] et al. [88], [PERSON] et al. [89], and [PERSON] and [PERSON] [90] employed authentication schemes using PINs to verify user identity. Using PINs, the schemes in [86, 87, 90] provided convenience, efficiency, reliability, and security in mobile transactions. Moreover, the schemes in [52, 85, 89] used PINs to achieve better dependability and customer satisfaction. The PIN should be easy to remember, random, and hard to guess, while it should be changed frequently, distinct for different accounts, and not written down or stored in plaintext [52]. However, using a PIN in mobile money authentication is susceptible to shoulder surfing attacks, brute force attacks, and smudge attacks [83, 84, 91]. * OTP: [PERSON], [PERSON], and [PERSON] [92] defined OTP as a unique and time-sensitive string of alphanumeric characters generated and forwarded to the user's mobile phone via either email or SMS for a single authentication session. Clock time-based OTP, pattern-based OTP, and random key-based OTP are the three methods used to generate OTP on the basis of the secret key derived from the Diffie-Hellman algorithm [93, 94]. The OTP generator located on the server machine creates the OTP and sends it to the user to complete the authentication process [95, 96]. If an adversary succeeds in accessing the OTP, they may not be able to predict the next because of its random generation. The authentication schemes in [71, 79, 86, 87, 90, 97, 98] employed OTP, which is fast, efficient, reliable, and convenient. Furthermore, it is resistant to phishing attacks, identity theft, guessing attacks, brute force attacks, and unauthorised access by attackers. * QR Code: A QR Code is a two-dimensional barcode encoded using standardised modes to store information that can be read using an imaging device such as a smartphone camera [99]. The swift expansion of QR code in mobile wallets is because of ease of use, security, cost-effectiveness, and trackability [100, 101]. The schemes proposed by [56, 71, 100, 102, 103] employed QR codes to ensure convenience, accuracy, confidentiality, nonrepudiation, integrity, speed, and safety in payment transactions.