# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 2 Related Work
### Studies Related to Mobile Money Systems
The uniqueness of the scheme is in the manner the fingerprint is captured for authentication by using the mobile device's camera, and the failure rate is minimized during fingerprint acquisition and authentication. However, the challenge with the scheme is that customer credentials are stored on the device, which can be a target point for the attackers. [PERSON] [13] discussed the current two-factor authentication that uses PIN and SIM for the mobile money system. The enrolment phase involves capturing and storing the subscriber's biodata, phone number, and PIN in the mobile network operators (MNO) database. During the verification phase, the user dials an unstructured supplementary service data (USSD) code, selects the service from the menu, and enters their mobile money PIN. If the PIN matches the copy stored in the MNO's database, the service requested is offered; otherwise, the user is asked to try the PIN up to three times. The model is user-friendly but susceptible to social engineering attacks, identity theft, shoulder-surfing attack, brute-force attack, replay attacks, MITM attacks, and PIN challenges. In 2015, [PERSON] [13] suggested a two-factor authentication system for enhancing mobile money security. The user biodata, PIN, and biometric fingerprint are collected and stored in the MNO database during the enrolment process. Then, the user is authenticated using a PIN and biometric fingerprint. The proposed scheme offers security against identity theft and shoulder-surfing attacks. However, it is susceptible to spoofing attacks, fake digital biometrics, Trojan horse attacks, matcher override or false matches, replay attacks, and intrusion attacks. [PERSON] and [PERSON] [19] proposed a wallet-on-wheels using the vehicle's identity to secure mobile money. The scheme integrates machine-to-machine (M2M), mobile money, automotive communications, and advanced security procedures. The user's biodata and e-mail address, the international mobile equipment identity (IMEI) of the phone, SIM, and car serial number are captured and stored in MNO's system during enrolment. The service authorization and authentication are done using both car-based and SIM-based methods. The secret serial numbers (IMEI) and embedded SIM authentication enhance the method remarkably. The security hashing procedure uses both the car serial number and the MNO's international mobile subscriber identity (IMSI) number to produce authentication keys for both wallet-on-wheels and MNO communications. The proposed system provides improved car-related paid services and a higher security platform against increasing fraud and identity theft. However, a wallet-on-wheels is restricted to authorized car drivers and car-enabled applications. The scheme involves different technologies and stakeholders, thus increasing the complexity of offering a uniform service. [PERSON] and [PERSON] [20] proposed a framework for electronic payment systems that use secure multi-factor user authentication. The user's biodata, password, and fingerprint are captured, verified, and stored in the database during the registration phase. In the authentication phase, the user must log in with the approved password and biometric fingerprint. The scanned biometric fingerprint is compared with the one stored in the database, and if it matches, the user signs in successfully and can go to the transaction phase. The user enters the amount to be transferred in the transaction phase and then authenticates by scanning the biometric fingerprint. If the biometric fingerprint matches, the system generates OTP and sends it to the user's registered phone number. The user is requested to enter the correct OTP. If the OTP matches, money is transferred, and the transaction is successful. The proposed framework increases the security of user authentication systems by offering multiple forms of protection to the authentication methods. It provides protection and trust in the electronic payment system.