# Two-Factor Authentication Scheme for Mobile Money: A Review of Threat Models and Countermeasures
## 2 Related Work
### Threat Models
#### 2.7.2 Attacks against Authentication  
This category is where attackers forge identities to impersonate authorised mobile money users to gain access to the system. [PERSON], [PERSON], and [PERSON] [8] further defined an authentication attack as a crime where attackers target and exploit the mobile money authentication process by applying a brute force attack against the PIN. Mobile money authentication attacks are classified into seven, namely, impersonation attack, replay attacks, masquerade attack, spoofing attacks, social engineering attack, phishing attack, and Trojan horse attacks. * Impersonation attacks: This is an attack where the adversary successfully assumes the identity of a legitimate mobile money user or agent to access either the MMS or the information and services of a registered user. People share their PINs among friends and families to perform transactionson their behalf. In case an attacker gets access to such a PIN, they can use it to log in to their mobile money accounts, perform fraudulent transactions, or change their PIN [8; 9; 12; 13; 46; 50; 51; 52]. * Replay attack: This is where an attacker eavesdrops on network communication between the mobile money user and MMS, intercepts the data packets that include the PIN, and then fraudulently delays or resends it to the recipient. This takes place in the form of eavesdropping on mobile communication, and mobile money platforms use SMS to notify mobile money users and agents. The SMS is protected using weak algorithms like the A5 and attackers with scanning software can easily intercept, modify, and resend them [45; 46; 50; 53]. The attacker can misuse the previously exchanged messages between the mobile money user and MMSP to perform the replay attacks [43]. * Masquerade attack: A masquerade attack is an attack where an adversary obtains the subscribers' SIM card and PIN and uses them either to request money from legitimate user's friends and relatives or to perform fraudulent transactions. This occurs when the attacker obtains the credentials of the authorised user through social engineering techniques and uses them to swap the SIM card. Furthermore, the adversary can also use fake documents to register the SIM cards of legitimate users and have full access to the mobile money account of the victims [14; 45; 50; 51]. * Spoofing attacks: This attack occurs when the adversary assumes the role of a mobile system administrator and has full access to the system. This is common because most mobile money applications and systems are poorly protected, thus giving opportunity for the attackers to hack them [16; 23]. * Social engineering attack: This is the manipulation of people to reveal confidential information like mobile money PIN so that the attacker can gain control over the user's mobile money account [19]. Mobile money platforms use PINs for securing mobile money accounts, which makes them vulnerable to many security threats, including social engineering attacks [19]. Attackers use social engineering techniques to circumvent mobile money's 2 FA scheme, compromise user accounts, and avoid fraud detection technologies [19]. * Phishing attacks: This is a deceitful attempt by adversaries to obtain confidential information such as mobile money PINs from mobile money users and agents by impersonating employees of MMSP in electronic communication. [PERSON], [PERSON], and [PERSON] [8] further expanded the definition as \"a form of mobile money crime where fraudsters masquerade as employees of the MMSP by calling or sending SMS messages to mobile money users and agents to reveal their data including PINs for an update\" (p. 18). Phishing starts when an adversary intercepts the network traffic between the mobile money user or agent and the mobile money application server and then uses a fraudulent call or message to lure the victim into revealing their credentials. The message is created to look as if it comes from the MMSP. Then, the victim is persuaded into providing the mobile money PIN to the fraudster [11].