# Two-Factor Authentication Scheme for Mobile Money: A Review of Threat Models and Countermeasures
## 4 Results and Discussion
* Social engineering attack: Mobile money platforms use PINs to secure mobile money accounts, thus making them vulnerable to many security threats, including social engineering attacks. Attackers also use social engineering techniques to circumvent mobile money's 2 FA scheme, compromise user accounts, and avoid fraud detection technologies. Security against social engineering attacks is ascertained using a multifactor authentication scheme, customer alert systems, and anti-phishing systems [108]. [PERSON] et al. [109], [PERSON], [PERSON], and [PERSON] [110], and [PERSON] and [PERSON] [111] adopted a multidimensional approach, including technology, policies, procedures, standards, employee training, and awareness programs. [PERSON] et al. [112] proposed an anomaly-based intrusion detection system to thwart SMS messaging attacks. * Phishing attacks: This is where fraudsters masquerade as staff of MMSP and call or send SMS messages to the subscribers to lure them into revealing their mobile money PIN. Resiliency against phishing attacks is enhanced by employing multifactor authentication, an anomaly-based intrusion detection system, email authentication, encryption, secure sockets layer, reports of suspicious activities, back-end analytics, user training and awareness, content-based filtering, blacklisting, and whitelisting [112; 113; 114]. [PERSON] and [PERSON] [115] used machine learning, profile matching, text mining, ontology, honeypots, and client-server authentication to detect phishing attacks. * Trojan horse attacks: Attackers use social engineering to trick mobile money users and agents into loading and executing Trojans on their phones. Once activated, Trojans can enable hackers to spy on mobile money users and agents, steal their mobile money PINs, and gain backdoor access to their mobile money accounts. The security against Trojan horse attacks was ensured in [68; 69] by using the idea of integrating biometrics and cryptography. [PERSON] et al. [116] proposed binary code obfuscation and hardware-based code attestation. [PERSON] and [PERSON] [106] adopted malware detection and prevention techniques. * Eavesdropping attacks: This is where an attacker secretly overhears information transmitted over the communication channel without being authorised by the trusted parties. The attacker takes advantage of unsecured network communications to access sensitive information. [PERSON], [PERSON], and [PERSON] [70] enforced security against eavesdropping attacks by using a message authentication code (MAC). [PERSON] and [PERSON] [66] proposed the use of ECIES and ECDSA. * Brute force attacks: This is a simple attack method with a high success rate because MMS uses numeric PINs of four or five digits to authenticate users. To deal with brute force attacks, [56; 77; 87] proposed the use of cryptographic hash functions. * Guessing attack: Mobile money users and agents use a PIN during mobile money authentication and the PIN used is only four or five digits, entered when unmasked, thus making it guessable. To thwart this attack, [66; 67; 68; 69; 70] employed the elliptic curve cryptosystem. [PERSON] and [PERSON] [87] adopted a password-salting mechanism. [PERSON], [PERSON], and [PERSON] [56] and [PERSON] et al. [77] used hashing functions. * Shoulder surfing attack: Attackers take advantage of crowded places to obtain mobile money agents' and users' PINs by looking over their shoulders while performing transactions. To resist this attack, [79; 80; 81; 85; 86; 89; 90; 105] emphasised the use of sightless multifactor authentication. * MITM attack: In this attack, the adversary sits between the mobile money user and MMSP and makes them believe that they are communicating directly with each other,when in fact the attacker controls the entire conversation. There are different authentication protocols [56; 66; 67; 68; 69; 70; 71; 73; 74; 76; 79; 85; 86; 90; 102; 103] that are resilient against MITM attacks. To deal with this attack, [66; 69] proposed the use of ECC.