## 1 Introduction  
Day by day, the power of attacks to guess or harvest passwords to gain illicit access to a system or data are becoming greater as the sophistication of password cracking techniques increases and high-power computing becomes more affordable. In the last three years, the number of phishing attacks for the purpose of account or identity theft has more than tripled [1]. During the third quarter of 2022 alone, there were 15 million data breaches, due to internet users around the world having their accounts compromised by attackers [2]. Nowadays, we are so susceptible to account theft attacks that, statistically, at least one of our online accounts (email, social networks, banks) will be hacked or subjected to an attempted hack in in the next 12 months [3]. Hence, there is an important need to have more robust and secure access mechanisms to protect data and systems.  
The most popular, yet the most basic, mechanism for user authentication is the use of passwords [4], mainly because the concept of using passwords is an efficient and cost-effective solution for user authentication. Passwords are an example of Single-Factor Authentication (SFA), which has been mostly adopted by the community due to its simplicity and user friendliness [5, 6]. The fundamental requirement for any password is that it should be easy to remember and must be sufficiently secure. In other words, the authentication process must be efficient, and passwords must be tough to guess [7]. Nevertheless, this is the weakest level of authentication [8, 9], and it has been realized that Single-Factor Authentication is not reliable to provide adequate protection, due to several security threats [10].  
Multi- factor authentication was proposed to provide higher levels of safety [11] and to add strong protection against account theft by greatly increasing the difficulty for attackers to gain access to information systems and data, even if passwords or PINs are compromised by phishing attacks or other means. MFA manages to do this with a layered approach, that is, with MFA a system requires a user to present a combination of two or more credentials to verify identity so access can be granted [12]. MFA mechanisms are mostly based on biometrics, which is automated recognition of individuals, based on their behavioral [13; 14], and biological characteristics [15]. However, the utilization of biological factors has its challenges, mainly related to ease of use [16], which largely impacts the usability of the MFA system. In addition, biometric mechanisms entail high implementation costs, and are still vulnerable to many different security attacks, such as presentation attacks, sensor output interception, denial of service attacks, and replay attacks [17], among others.  
This paper proposes a novel multi-factor authentication mechanism that does not require additional hardware and is solely based on images and their user-established relations. The combination of text and graphics increases the password space, thereby making the authentication mechanism more robust and secure against various types of security threats. The contributions of this research work are the following:  
* The design of a novel MFA algorithm, based on image selection and user-established relations.
* Functional prototype of the mechanism developed and deployed as a mobile application available for IOS and Android.
* An analysis of the accuracy, security, and usability results focusing on the benefits and areas of opportunity that working with an image selection and relations-based algorithm has in an MFA mechanism.