# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 2 Related Work
### Technologies  
The study used the following technologies to provide secure and efficient multi-factor authentication. Personal Identification Number (PIN)  
A PIN in mobile money is a numeric password that can authenticate subscribers in an electronic transaction. The PINs used in mobile money authentications are often four or five digits [11]. The PIN value as a means of authentication depends entirely on its secrecy from the moment the PIN is created until entered into the system. Many systems and applications adopt the PIN-entry method due to its convenience, efficiency, reliability, better dependability, and customer satisfaction in mobile transactions [27]. Using PIN alone for authentication is risky and vulnerable to shoulder-surfing attacks, replay attacks, PIN leakage, guessing attacks, eavesdropping, phishing attacks, spoofing, MITM attacks, and malware attacks [9; 11; 28]. One-Time Password (OTP)  
A One-Time Password is a dynamic password that is effective only for a short period and valid for only one login session [28; 29]. OTP can be time-based, pattern-based, and random key-based and is delivered via SMS, OTP application, RSA token, and e-mail [28]. The principle of OTP is to share a seed between a generator and a verifier where both can produce the same password. The generator is responsible for generating an appropriate OTP from the shared seed. The verifier is responsible for validating the OTP and storing the last valid OTP received and the current one. SMS-based OTP is most commonly used in multi-factor authentication for many different applications because it is cheap, fast, efficient, reliable, and convenient. Using OTP aims to prevent fraudulent attacks such as phishing attacks, shoulder-surfing attacks, replay attacks, eavesdropping, spoofing attacks, brute-force attacks, MITM attacks, and identity theft. OTP is also resilient to reverse engineering [9; 11; 28; 30; 31]. Quick Response (QR) Code  
A QR code is a two-dimensional, matrix populated, square-shaped, and machine-readable optical label used to store information about the item based on their allocation capacity [32; 33; 34]. It is represented by black and white square image blocks called modules. Each module describes some data, where the black square holds value 1 and the white square holds 0. Both black and white colors permit encoding and decoding of the data [35; 36]. Each QR codes stores vertical and horizontal strings of text comprised of standardized encoding modes, i.e., numeric characters, alphanumeric characters, letters, symbols, Byte characters, and Kanji/Kana [35; 37; 38]. It can encode 7089 numeric characters, 4296 alphanumeric characters, 2953 bytes [33; 35; 36]. The encoded information in the QR code can be decoded using a handheld scanner or a QR code scanner app installed on a smartphone [33]. QR codes are widely used in security-related operations such as authentication and identification. The QR code is rapidly being adopted in mobile payments because of its speed in terms of decoding, convenience, ease of use, security and privacy, cost-effectiveness, traceability, ample data storage, robustness against damages/error correction capability, flexibility, easy readability, the fact that it is easy to generate and manage, its user-friendly nature, its versatility, and its accuracy [38; 39; 40; 41; 42; 43; 44; 45]. Likewise, they provide data confidentiality and integrity; ensure non-repudiation; and prevent identity theft, impersonation attacks, shoulder-surfing attacks, and brute-force attacks [46]. According to [PERSON] et al. [47], fingerprint recognition is a visual type of authentication that identifies individuals using the ridges and valleys found on the surface of fingers. The skin on the fingertip's surface consists of raised folds of skin, called ridges, and valleys separate these ridges. The pattern of ridges and valleys on a fingertip represents a fingerprint used in biometric recognition. Fingerprint recognition is commonly used for authentication on computerized systems [23].