Two-Factor Authentication Scheme for Mobile Money: A Review of Threat Models and Countermeasures

Abstract

The proliferation of digital financial innovations like mobile money has led to the rise in mobile subscriptions and transactions. It has also increased the security challenges associated with the current two-factor authentication (2FA) scheme for mobile money due to the high demand. This review paper aims to determine the threat models in the 2FA scheme for mobile money. It also intends to identify the countermeasures to overcome the threat models. A comprehensive literature search was conducted from the Google Scholar and other leading scientific databases such as IEEE Xplore, MDPI, Emerald Insight, Hindawi, ACM, Elsevier, Springer, and Specific and International Journals, where 97 papers were reviewed that focused on the topic. Descriptive research papers and studies related to the theme were selected. Three reviewers extracted information independently on authentication, mobile money system architecture, mobile money access, the authentication scheme for mobile money, various attacks on the mobile money system (MMS), threat models in the 2FA scheme for mobile money, and countermeasures. Through literature analysis, it was found that the threat models in the 2FA scheme for mobile money were categorised into five, namely, attacks against privacy, attacks against authentication, attacks against confidentiality, attacks against integrity, and attacks against availability. The countermeasures include use of cryptographic functions (e.g., asymmetric encryption function, symmetric encryption function, and hash function) and personal identification (e.g., number-based and biometric-based countermeasures). This review study reveals that the current 2FA scheme for mobile money has security gaps that need to be addressed since it only uses a personal identification number (PIN) and a subscriber identity module (SIM) to authenticate users, which are susceptible to attacks. This work, therefore, will help mobile money service providers (MMSPs), decision-makers, and governments that wish to improve their current 2FA scheme for mobile money.

Prototype mobile contactless transaction system in traditional markets to support the covid-19 physical distancing program

“…The implementation of a payment gateway in the system makes this service have a transaction authentication process as well as ease of data processing, where the monitoring process can be carried out in real-time, making it easier to confirm every incoming fund, make sales reports, and find out customer details. However, the security of the electronic payment system is also something that needs to be considered by applying multiple security methods [29], as well as considering factors related to its advantages and disadvantages when used [30]. In addition, the prototype that was built still only uses one e-wallet service where this limits the flexibility of users in the payment process for their transactions, as well as the trust of users who are still unfamiliar with the use of e-wallet in their transactions.…”

A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications

“…However, to date, there are no strong security controls to suit all mobile money authentication security challenges. However, the existing proposed algorithms, though promising, require more work because they are vulnerable to impersonation attacks; USSD technology vulnerabilities; replay attacks; spoofing attacks; Trojan horse attacks; bruteforce attacks; shoulder-surfing attacks; MITM attacks; insider attacks; identity theft; social engineering attacks; SIM-swapping attacks; malware attacks; agent-driven fraud; and privacy attacks [8,9,11,[22][23][24][25][26]. Therefore, there is a need to develop a secure and efficient multi-factor authentication algorithm for mobile money applications where mobile money subscribers are authenticated using a PIN, OTP, and biometric fingerprints.…”

“…A PIN in mobile money is a numeric password that can authenticate subscribers in an electronic transaction. The PINs used in mobile money authentications are often four or five digits [11]. The PIN value as a means of authentication depends entirely on its secrecy from the moment the PIN is created until entered into the system.…”

“…Today, most mobile money systems authenticate their subscribers using a PIN and SIM. This 2FA scheme, though promising, is weak, thus increasing the number of security challenges [8,9,11] due to the short PIN length (4 or 5 digits) used, the same PIN being used to authenticate all mobile money services, the fact that there is no expiry date for the PIN, the fact that sharing the PIN among users takes place and the fact that the PIN is entered when unmasked during verification [12,13].…”

Security in Next Generation Mobile Payment Systems: A Comprehensive Survey

“…Various attacks are included in this form of attacks, such as Trojan horse attack, phishing attack, social engineering attack, spoofing attacks, masquerade attack, replay attacks, and impersonation attack. An attacker assumes the identity of a legitimate user in an impersonation attack [76], [77], [70], [71], whereas entire communication is subjected to eavesdropping in replay attack before intercepting [78]. In a masquerade attack, the PIN and SIM card are acquired by the users.…”