The proliferation of digital financial innovations like mobile money has led to the rise in mobile subscriptions and transactions. It has also increased the security challenges associated with the current two-factor authentication (2FA) scheme for mobile money due to the high demand. This review paper aims to determine the threat models in the 2FA scheme for mobile money. It also intends to identify the countermeasures to overcome the threat models. A comprehensive literature search was conducted from the Google Scholar and other leading scientific databases such as IEEE Xplore, MDPI, Emerald Insight, Hindawi, ACM, Elsevier, Springer, and Specific and International Journals, where 97 papers were reviewed that focused on the topic. Descriptive research papers and studies related to the theme were selected. Three reviewers extracted information independently on authentication, mobile money system architecture, mobile money access, the authentication scheme for mobile money, various attacks on the mobile money system (MMS), threat models in the 2FA scheme for mobile money, and countermeasures. Through literature analysis, it was found that the threat models in the 2FA scheme for mobile money were categorised into five, namely, attacks against privacy, attacks against authentication, attacks against confidentiality, attacks against integrity, and attacks against availability. The countermeasures include use of cryptographic functions (e.g., asymmetric encryption function, symmetric encryption function, and hash function) and personal identification (e.g., number-based and biometric-based countermeasures). This review study reveals that the current 2FA scheme for mobile money has security gaps that need to be addressed since it only uses a personal identification number (PIN) and a subscriber identity module (SIM) to authenticate users, which are susceptible to attacks. This work, therefore, will help mobile money service providers (MMSPs), decision-makers, and governments that wish to improve their current 2FA scheme for mobile money.

With the expansion of smartphone and financial technologies (FinTech), mobile money emerged to improve financial inclusion in many developing nations. The majority of the mobile money schemes used in these nations implement two-factor authentication (2FA) as the only means of verifying mobile money users. These 2FA schemes are vulnerable to numerous security attacks because they only use a personal identification number (PIN) and subscriber identity module (SIM). This study aims to develop a secure and efficient multi-factor authentication algorithm for mobile money applications. It uses a novel approach combining PIN, a one-time password (OTP), and a biometric fingerprint to enforce extra security during mobile money authentication. It also uses a biometric fingerprint and quick response (QR) code to confirm mobile money withdrawal. The security of the PIN and OTP is enforced by using secure hashing algorithm-256 (SHA-256), a biometric fingerprint by Fast IDentity Online (FIDO) that uses a standard public key cryptography technique (RSA), and Fernet encryption to secure a QR code and the records in the databases. The evolutionary prototyping model was adopted when developing the native mobile money application prototypes to prove that the algorithm is feasible and provides a higher degree of security. The developed applications were tested, and a detailed security analysis was conducted. The results show that the proposed algorithm is secure, efficient, and highly effective against the various threat models. It also offers secure and efficient authentication and ensures data confidentiality, integrity, non-repudiation, user anonymity, and privacy. The performance analysis indicates that it achieves better overall performance compared with the existing mobile money systems.

Smartphone technology has improved access to mobile money services (MMS) and successful mobile money deployment has brought massive benefits to the unbanked population in both rural and urban areas of Uganda. Despite its enormous benefits, embracing the usage and acceptance of mobile money has mostly been low due to security issues and challenges associated with the system. As a result, there is a need to carry out a survey to evaluate the key security issues associated with mobile money systems in Uganda. The study employed a descriptive research design, and stratified random sampling technique to group the population. Krejcie and Morgan’s formula was used to determine the sample size for the study. The collection of data was through the administration of structured questionnaires, where 741 were filled by registered mobile money (MM) users, 447 registered MM agents, and 52 mobile network operators’ (MNOs) IT officers of the mobile money service providers (MMSPs) in Uganda. The collected data were analyzed using RStudio software. Statistical techniques like descriptive analysis and Pearson Chi-Square test was used in data analysis and mean (M) > 3.0 and p-value < 0.05 were considered statistically significant. The findings revealed that the key security issues are identity theft, authentication attack, phishing attack, vishing attack, SMiShing attack, personal identification number (PIN) sharing, and agent-driven fraud. Based on these findings, the use of better access controls, customer awareness campaigns, agent training on acceptable practices, strict measures against fraudsters, high-value transaction monitoring by the service providers, developing a comprehensive legal document to run mobile money service, were some of the proposed mitigation measures. This study, therefore, provides a baseline survey to help MNO and the government that would wish to implement secure mobile money systems.

The proliferation of counterfeit educational certificates is an ongoing issue around the world, including Tanzania. The effect of this malpractice is detrimental to the credibility of education. Traditional strategies to prevent fake certificates are abortive, calling for a more sophisticated approach. Blockchain technology has recently emerged as an ideal solution to this problem due to its inherent attributes that ensure disintermediation, immutability, tamper proof, anonymity, transparency, consensus, security, and trust. However, most existing blockchain-based solutions lack crucial functionalities that are pertinent to the Tanzanian education system. This study unveiled the challenges faced by the current verification system in Tanzania and proposed a blockchain-based conceptual model to address them. The proposed model is based on blockchain, smart contracts, and the Interplanetary File System (IPFS). Quantitative and qualitative methods were used to investigate certification problems in Tanzania and modeling techniques were used to construct the conceptual model. The findings showed that the main challenges of the current verification system emanate from manual procedures, unverifiable credentials, susceptibility of centralized storage systems, disintegrated verification systems, revocation problems, difficulties in communication, and high dependency on the issuers. These challenges undermine certificate verification, impose a significant setback in the fight against forgeries, and create loopholes. It was conceptually demonstrated that these issues can be resolved through the proposed blockchain-based solution.

The prevalence of fake educational credentials poses a threat to the meritocracy of education and job markets. Verification of the certificates to combat the forgeries has been a challenging endeavor due to the weaknesses of the current methods. Blockchain, capitalizing on its unique attributes, can provide an optimal solution to certification and verification problems by ensuring disintermediation, immutability, tamper-proof, efficiency, and security. Efforts to explore its potential in addressing these problems continue to gain momentum. However, the existing blockchain-based initiatives do not offer a holistic solution to the forgery problem, as they solely focus on a single education level or institution. Furthermore, these initiatives lack the essential features to fully address this problem. This paper proposes a comprehensive blockchain-enabled system for issuing certificates from different educational levels and institutions in the country, providing a one-stop center for verifiers, such as employers, to verify all certificates a candidate possesses. As a proof of concept, we have developed a decentralized application (DApp), ElimuChain, utilizing smart contracts and the InterPlanetary File System (IPFS). The system is deployed on the Binance Smart Chain (BSC) blockchain to evaluate its applicability in addressing the problem in the Tanzanian context. The results demonstrate that the proposed solution successfully manages the certification and verification process and it is cost-effective, scalable, and efficient. Moreover, its performance was compared with the previous solutions in terms of latency and throughput. The comparison results show that it performs better than the counterpart for transactional operations.