Secure Mobile Internet Banking System Using QR Code and Biometric Authentication

Abstract

With the digital technology explosion, Internet banking users increased exponentially due to worldwide accessibility and convenience. The leading challenge of online banking is to ensure security for online transactions and the accounts of customers. Phishing attempts to get user’s login credentials like username and password by disguising themselves as a trusted entity in the banking sector. SIM swap is a new cyber fraud, where the attacker collects the personal data of the bank customer and gets a new SIM card. The attacker can easily steal the user’s login credentials like user name and password using phishing attack and the OTP using the SIM swap fraud attack. This study analyzes the security of the online banking system and proposes a new anomaly-based fraud detection method to overcome phishing and SIM swap fraud attacks. The login attributes like IP address, device, cookie, operating system, and browser are used to generate and update the user’s profile. The primary user profile contains the most recently used login attributes, and the second profile contains the most frequently used login attributes. If the current login attributes match either the primary or secondary user profile, the user can access their account. Otherwise, additional security mechanisms like OTP with QR code or biometric authentication or both are used to identify the suspicious behavior of the user. The proposed method reduces the login burden of the user and provides better security for the online mobile banking system.