Received 25 November 2023, accepted 16 December 2023, date of publication 22 December 2023,

date of current version 4 January 2024.

Digital Object Identifier 10.1109/ACCESS.2023.3346045

Online Banking User Authentication Methods:

A Systematic Literature Review
NADER ABDEL KARIM 1 , OSAMA AHMED KHASHAN 2 , HASAN KANAKER3 ,
WALEED K. ABDULRAHEEM 4 , MOHAMMAD ALSHINWAN 5,6 ,
AND ABEDAL-KAREEM AL-BANNA7
1 Department of Intelligent Systems, Faculty of Artificial Intelligence, Al-Balqa Applied University, Al-Salt 19117, Jordan
2 Research and Innovation Centers, Rabdan Academy, Abu Dhabi, United Arab Emirates
3 Department of Cyber Security, Isra University, Amman 11622, Jordan
4 Information Systems and Networks Department, The World Islamic Sciences and Education University, Amman 11947, Jordan
5 Faculty of Information Technology, Applied Science Private University, Amman 11931, Jordan
6 MEU Research Unit, Middle East University, Amman 11831, Jordan
7 AI and Data Science Department, University of Petra, Amman 11196, Jordan

Corresponding authors: Nader Abdel Karim ([email protected]) and Osama Ahmed Khashan ([email protected])

ABSTRACT Online banking has become increasingly popular in recent years, making it a target for
cyberattacks. Banks have implemented various user authentication methods to protect their customers’
online accounts. This paper reviews the state-of-the-art user authentication methods used in online
banking and potential cyber threats. This paper starts by exploring different user authentication methods,
such as knowledge-based authentication (KBA), biometrics-based authentication (BBA), possession-based
authentication (PBA), and other methods. The advantages and disadvantages of each user authentication
method are then discussed. Furthermore, the paper discusses the various cyber threats that can compromise
user authentication for online banking systems, such as malware attacks, social engineering, phishing attacks,
man-in-the-middle (MiTM) attacks, denial of service (DoS) attacks, session hijacking, weak passwords,
keyloggers, SQL injection, and replay attacks. Also, the paper explores the user authentication methods used
by popular banks, which can provide insights into best practices for safeguarding online banking accounts
and future user authentication methods in online banking and cyber threats. It states that the increasing use of
BBA, two-factor authentication (2FA), and multi-factor authentication (MFA) will help improve the security
of online banking systems. However, the paper also warns that new cyber challenges will emerge, and banks
need to be vigilant in protecting their customers’ online banking accounts.

INDEX TERMS User authentication, online banking, cyber threats, 2FA, MFA, cyber challenges.

I. INTRODUCTION customers can execute online payments and other financial

The tendency towards online business has grown dramatically operations, as well as remote access to their bank accounts
in recent years. In the banking sector, where most banks and additional financial information. Online banking services
have started to offer their services online, online services are have susceptible data and online banking tools must be
increasingly predominant. According to the Pew Research enhanced with effective and reliable security mechanisms.
Center, in reported USA in 2013, 61% of internet users in A robust authentication is necessary to provide high security
the USA were using online banking, which is set to rise to and privacy [4], [5]. The method by which people prove
77.6% by 2022 [1]. Online banking, also known as e-banking their identity to gain access to online banking platforms is
or Internet banking, is an electronic payment system that known as user authentication. User authentication methods
enables bank or other financial organization clients to transact are used to verify the identity of a user trying to access
over the Internet [2], [3]. Using online banking services, an online system. There are three main types of user
authentication methods: KBA, BBA, and PBA. Recently,
The associate editor coordinating the review of this manuscript and 2FA and MFA have become increasingly common [6], [7]
approving it for publication was Pedro R. M. Inácio . (see Figure 1).

2023 The Authors. This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 License.
VOLUME 12, 2024 For more information, see https://creativecommons.org/licenses/by-nc-nd/4.0/ 741
 N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

FIGURE 1. The general user authentication classifications.

KBA -Something you know- is the most popular user Password -OTP), a fingerprint scan, or facial recognition [15],
authentication technique because it depends on the user [16]. 2FA is more secure than single-factor authentication
knowing something. It asks the user to enter information that (SFA), requiring only one user authentication method, such
should only be known by them, such as a password, PIN, as a password. This is because even if someone knows your
or challenge question (also known as a security question). password, they will still need access to your phone or other
KBA is simple to set up and use, but it can be vulnerable devices to enter the second factor [8], [17].
to attacks such as guessing, phishing, brute force, and social Recently, many financial institutions have added a layer
engineering attacks [7], [8]. BBA -Something you are- is of security called MFA to their security systems to contain
a form of a user authentication technique that relies on sophisticated attacks and to add a higher degree of protection
what the user is and checks the user’s physiological or to sensitive operations [18], [19]. MFA combines various
behavioral characteristics to confirm their identity [9], [10]. forms of user authentication (More than two), such as
The physical characteristics of a user, like fingerprints, facial something the user is (biometric data), something the user
features, or iris scans, are used in physiological biometrics has (a smartphone or token), and something they know (a
to confirm their identification. Patterns in the user’s voice, password) [13], [20]. An in-depth examination of the various
keystrokes, and other characteristics can be found using MFA techniques used in online banking will be done in this
behavioral biometrics [11]. Although BBA can be more review, along with an assessment of how well they contribute
intrusive and challenging to implement than KBA, it is to user convenience while enhancing security [13], [21].
more secure [12] PBA, also called a Token -Something you Moreover, this review will look at newly developed
have-, depends on something the user already possesses. The authentication technologies, such as biometrics (fingerprint,
user must own a tangible item, such as a smartphone or a facial recognition) and behavioral biometrics (Voice pattern,
security token. While PBA can be more inconvenient for keystroke dynamics), which are gaining popularity in the
the user than KBA, it is more secure [4], [8]. This study online banking industry. These methods use distinctive
intends to provide a systematic literature review (SLR) of the physiological or behavioral traits to verify a user’s identity,
various user authentication methods used in online banking providing a more streamlined and secure user experience.
systems and investigate potential cyber threats that may Additionally, this review aims to contribute to the present
threaten and attempt to bypass these methods. Historically, debate on improving online banking systems’ security and
the most common authentication method has been username user experience by exploring emerging technologies and
and password combinations [12]. Nevertheless, the rise of demonstrating threats facing online banking user authenti-
sophisticated cyber threats has shown that relying solely on cation. Ultimately, the study’s findings will aid financial
passwords is insufficient to prevent unauthorized access to institutions and policymakers in making defensible choices
user accounts [13], [14]. Two-factor authentication, or 2FA, regarding adopting robust user authentication techniques in
is an extra layer of security that can be added to your online banking, ensuring the security of users’ financial
online banking account. It is a security process requiring information in a world that is becoming more interconnected.
two pieces of information to verify a user’s identity. The The rest of this paper is structured as follows:
first factor is typically a password, while the second factor Section II presents the advance of this paper over existing
can be something like a code sent to your phone( One Time work, Section III provides the methodology, Section IV

742 VOLUME 12, 2024

N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

demonstrates the analysis and discussion, Section V presents TABLE 1. Search keywords.
challenges facing online banking user authentication, and
Section VI offers the conclusion.

II. ADVANCEMENT OVER EXISTING WORKS

Online banking user authentication is a critical and chal-
lenging problem that requires continuous research and
development to ensure the security and comfort of online
banking customers. However, there is a lack of a complete
and up-to-date review of the available literature on this
topic. Most earlier review studies need to be updated or • RQ3: What are current user authentication methods used
focused on a certain type of user authentication technique by well-known banks worldwide?
or model. For example, the authors of [22] and [23] did
research on authentication and communications security in B. SEARCH STRATEGY
online banking. Their publications, however, were published In this phase, we focused on scientific digital libraries and
in 2016 and 2018, respectively, and did not incorporate recent databases, search keywords, reference management tools, and
advancements and trends in this area. Likewise, authors a search process. We describe each process in the following
in [24], [25], and [13] analyzed user authentication models or subsections.
approaches for online banking, but their papers were limited
to a specific component or category of user authentication, 1) SCIENTIFIC DIGITAL LIBRARIES
such as mobile IMEI number, advanced security solutions,
This review was done on several popular scientific digital
or MFA. Furthermore, other review articles, such as [26],
libraries and databases in English. The scientific digital
addressed user authentication in general rather than the
libraries and databases searched were Science Direct,
specific context and limits of online banking. As a result,
Springer Link, IEEE Xplore, ACM, and Google Scholar.
we accomplished an SLR on online banking user authentica-
tion methods from 2013 to 2023. Our SLR is comprehensive
2) SEARCH KEYWORDS
and complete, as it covers all types of online banking user
The search keywords were derived from the SLR research
authentication methods and categories, including PBA, KBA,
questions. We have also included synonyms and alternatives.
BBA, 2FA, and MFA. Our SLR is also innovative and timely
The synonym keywords are taken from the literature on
in that it gives a review and analysis of the current state-of-
online banking security topics. Table 1 displays the search
the-art online banking user authentication systems, as well
keywords used in the above-mentioned digital libraries.
as identifying emerging trends, and challenges in this field.
We hope that our SLR can contribute to the advancement of
3) REFERENCE MANAGEMENT
knowledge and practice of online banking user authentication
methods, as well as clarify and guide future research and In this SLR, the Mendeley Reference Manager v2.90.0 [28]
development in this field. was used as a reference management tool to collect and
manage the retrieved scientific papers. It enabled researchers
to easily manage, edit, add, and remove documents from the
III. METHODOLOGY
tool’s internal database.
To survey existing state-of-the-art associated online banking
authentication methods, an SLR was accomplished uti-
4) SEARCH PROCESS
lizing the procedures mentioned by the EBSE Technical
Report [27]. The publishing date range was defined as Jan 2013 through
the end of May 2023. The focus was established on articles
identified with online banking authentication or threats. All
A. RESEARCH QUESTIONS
other insignificant articles were omitted. The search was
The main goal of this research is to investigate the current user started in Jun 2023. Table 2 demonstrates all results related
authentication methods that could be used in online banking to each Digital library. The selection of the study involved
systems. This research also focuses on online banking user multiple phases. First, potentially relevant articles were
authentication cyber threats and provides examples of already identified using search strings, and then the publication’s
used user authentication methods by famous worldwide titles and abstracts were screened. As a result, many papers
banks. To cover the aims and objectives of this SLR, we pose were omitted; based on their insignificance to the research
the following research questions: questions. Next, if there were any suspicions about the
• RQ1: What existing authentication methods/techniques potential publication’s inclusion, the entire article would be
can authenticate online banking users? obtained for further evaluation [27].
• RQ2: What potential user authentication cyber threats Complete content scanning was performed on the last set
affect online banking? of journals. Thus, a group of publications was involved in the

VOLUME 12, 2024 743

 N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

TABLE 2. Search keywords. correctly. To maintain maximum security, it’s critical to

choose a robust password policy (e.g., NIST, OWASP
password policy) and choose unique passwords or PINs
and update them frequently; also, using passphrases is an
excellent option to ensure longer passwords, which makes
passwords more difficult to crack [52]. Moreover, Graphical
passwords are a way to authenticate users by using images
or shapes. They are more secure than passwords and PINs
because they are harder to guess or brute-force. This is
because there are many more possible combinations of
review, depending on its relevance to the research questions images than there are possible combinations of characters.
and clearance of their objectives and methodology. The total However, graphical passwords can be harder to remember
number of papers used in this review (after removing search than passwords and PINs, so it is essential to choose a system
redundant and missing information papers) was 65 articles. that is easy to use and remember [8], [53]. Security questions
are an additional layer of security that can help protect your
IV. ANALYSIS AND DISCUSSION account. However, if the answers to your security questions
This section presents several samples of data extracted are easy to guess or find (e.g., in the user’s social accounts),
from relevant studies as well as an analysis and discussion they may not be very effective [8]. That’s why choosing
of the SLR results. Table 3 summarizes some of the challenging and unique security questions only you know the
collected literature within three sections: year, reference, and answers to is essential. This will help to keep your account
description. safe from unauthorized access.

A. USER AUTHENTICATION METHODS IN ONLINE

BANKING 2) BBA METHODS
This subsection answers RQ1: ‘‘What existing authentication In BBA category, both physiological biometrics (such as
methods/techniques can authenticate online banking users?’’ fingerprint and face ID) and behavioral biometrics (including
Figure 2 shows the classification of available authentication voice patterns, keystroke dynamics, and tapping behavior)
methods that can be used in online banking, along with user are employed [11], [39], [54], [55]. Physiological biometrics
authentication methods proposed by authors of each category. leverage unique biological traits to verify user identity,
Figure 2 shows that various online banking user authentica- providing high security. Similarly, behavioral biometrics
tion methods are used and categorized into KBA, BBA, PBA, analyzes user behavior for authentication purposes, offering a
and Other Methods. This classification allows for a com- robust authentication mechanism, but it raises concerns about
prehensive understanding of the strengths and weaknesses privacy and the security of the stored data. Implementing
associated with each authentication type, shedding light on robust measures to protect against unauthorized access or
the diverse range of methods employed within the online misuse of biometric information [47]. Moreover, implement-
banking sector. ing biometric authentication can be complex and may not
work for all users. Factors such as hardware requirements,
1) KBA METHODS
accuracy, and user acceptance must be considered when
implementing biometrics in online banking systems [56],
Under the category of KBA, methods such as passwords,
[57], [58].
PINs, and challenge questions are commonly used in
conjunction with other authentication factors. The PIN is an
abbreviation for a personal identification number, a secret 3) PBA METHODS
number only the customer knows and can use to prove their PBA techniques use a physical object or a code that the user
identity [44]. The security of PIN as user authentication in owns to confirm their identity. PBA techniques have several
online banking depends on the length and complexity of benefits and issues [8]. QR code authentication involves
the PIN; according to the PCI-DSS standards, which are scanning a unique QR code to authenticate the user. This
the global security standards for payment card transactions, can complicate unauthorized access attempts, as the QR
PINs should be at least four digits long and should not be code is challenging to replicate. However, there is a risk
based on easily guessed information depends on the length of QR code copying or theft, which can undermine its
and complexity of the PIN [50]. A password is secret data, effectiveness [59]. One-time password (OTP) authentication
typically a string of characters. Generally, passwords provide generates temporary and exclusive authentication tokens
a higher level of security than PINs due to their length [8], delivered through SMS or email. This method provides an
[51]. Passwords are also more complex and challenging to additional layer of security, as the generated OTPs are only
guess because they can contain various characters, including valid for a limited time. However, it relies on protecting
alphanumeric and special characters. However, passwords the communication channels the OTPs deliver [35], [60].
and PINs can be subject to security breaches if not picked Security/USB keys are physical devices that users possess

744 VOLUME 12, 2024

N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

TABLE 3. Sample of data extraction.

FIGURE 2. Taxonomy of user authentication methods for online banking.

and use for authentication. These keys provide a higher the key to authenticate. However, the implementation and
level of security, as they require the physical presence of compatibility of security/USB keys may pose challenges,

VOLUME 12, 2024 745

 N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

and users need to ensure the safekeeping of the physical be required to enter their PIN and answer a security question
key [40], [61]. Wearable devices, such as smartwatches or to log in to their online banking account. BBA methods, such
fitness trackers, can be used for authentication. These devices as fingerprints, facial recognition, and behavioral biometrics,
leverage the physical presence of the user as an authentication were commonly integrated into MFA or 2FA setups. PBA
factor. Wearable devices offer convenience and portability methods, including OTPs, security/USB keys, wearable
but must be securely paired with the user’s online banking devices, and image-based authentication, were often used
account to ensure reliable authentication [34], [62]. OffPAD alongside other factors. Additional techniques like FIDO,
(Offline Personal Authentication Device) is a dedicated QR codes, geolocation, IP addresses, and CAPTCHA were
device that allows users to authenticate offline. It stores user also incorporated into MFA or 2FA setups to enhance
credentials securely and verifies them without requiring an security. By combining different types of authentication
internet connection. OffPADs provide an additional layer methods, banks can significantly improve the security of
of security by keeping the authentication process isolated their systems and create a layered security approach that is
from online threats. However, the availability and adoption difficult for attackers to crack. This is because if the attacker
of OffPADs may vary, and users need access to such compromises one layer, the rest of the layers will protect the
devices to benefit from this authentication method [30], system [4], [6], [73]. For example, a user might be required to
[63]. Image-based authentication requires users to possess enter their password and then provide a fingerprint scan to log
specific images for authentication purposes. These images into a system. This would make it much more difficult for an
serve as a visual representation of the user’s identity [46], attacker to access the system, even if they guessed the user’s
[64]. While image-based authentication can be convenient for password. So, when online banking adopts the 2FA and MFA,
users, it relies on the security of the image database and the this will establish a comprehensive and robust authentication
potential vulnerability of images being copied or stolen. process, mitigating risks associated with relying solely on a
single factor [74], [75], [76].
4) OTHER AUTHENTICATION METHOD Table 4 summarizes the strengths and weaknesses of all
previously mentioned online banking user authentication
The ‘‘Other Authentication Methods’’ category includes
methods.
various techniques, each with its strengths and weaknesses.
Based on a compilation of 28 research, Table 5 and Figure 3
MAC addresses and IMEI numbers are unique identifiers
offer an overview of the authentication methods utilized
assigned to devices, which can enhance security mea-
in online banking user authentication systems. The data
sures [65]. However, they are not foolproof, as determined
obtained from the table offers an in-depth investigation of
attackers can spoof or change them [43]. IP addresses and
the authentication techniques used in these systems, complete
geolocation can provide additional security by verifying the
with matching references. The table illustrates the wide
user’s location [33], [66]. However, they can be masked
variety of authentication methods that are used to guarantee
or manipulated using proxy servers or virtual private
safe access to online banking services.
networks (VPNs), reducing their effectiveness as standalone
The talk that follows looks at the frequency with which
authentication methods [41], [67], [68]. CAPTCHA tests,
specific authentication techniques are applied and how they
widely used to distinguish between humans and automated
are integrated in the MFA and 2FA, as shown in Table 5 and
bots, typically involve visual or auditory challenges requiring
Figure 3.
human interpretation [69]. While CAPTCHAs serve as
With 12 appearances each, fingerprint and password
an effective deterrent against bots, advanced algorithms,
authentication stand out among these methods as the most
or Optical Character Recognition (OCR) technology can
frequently used within the MFA and 2FA frameworks. OTPs
potentially bypass them, compromising their reliability.
(SMS) were used nine times and PINs were used six times.
FIDO (Fast Identity Online) is another authentication method
Other methods that were commonly used include keystroke
that uses public-key cryptography and biometrics to provide
dynamics (3 times), offPAD (2 times), IP addresses (2 times),
passwordless authentication [35], [70]. FIDO offers enhanced
and face ID (2 times). Several authentication methods, includ-
security by eliminating the need for passwords and relying
ing graphical passwords, wearable devices, OTPs (email),
on solid authentication through biometrics and cryptographic
challenge questions, voice patterns, mouse dynamics, FIDO,
keys. However, FIDO’s implementation, infrastructure, and
security key/USB devices, tapping behavior, QR codes, MAC
compatibility may pose challenges that must be considered
addresses, IMEI numbers, geolocation, and CAPTCHA, were
in online banking systems [71].
mentioned once or used in limited instances.
The repeated usage of passwords, OTP (SMS), and
5) 2FA AND MFA fingerprint as part of MFA highlights their effectiveness in
The system developers commonly integrated the above enhancing security. Additionally, the combination of various
authentication methods into 2FA or MFA framework [9], authentication methods within the MFA and 2FA frameworks
[19], [72]. For example, in the KBA category, PINs, exemplifies the significance of implementing layered security
passwords, graphical passwords, and security questions were measures to protect user accounts and sensitive data in online
frequently used with other factors. For example, users might banking systems. For example, the combination of password

746 VOLUME 12, 2024

N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

and OTP (SMS) was used four times in the table, showing that 6) MiTM ATTACKS
organizations use layered security measures to protect their An attacker performs a MiTM attack by listening to conver-
systems. sations between the user and the online banking system. This
enables the attacker to gather private information that may
B. THREAT-FACING ONLINE BANKING be utilized for fraud or unauthorized access, such as login
In this subsection, we provide answers found regarding RQ2: credentials or financial information [96], [97].
‘‘What potential user authentication cyber threats affect
online banking?’’. Based on the literature [4], [54], [72], [85], 7) DoS ATTACKS
[18], [87], [88], [89], [90], [91], [92], [93], [94], [95], [96], DoS attacks block genuine users from accessing online
[97], [98], [99], [100], [101], [102] the following are the most banking systems by flooding the system with excessive
serious threats that could face online banking: traffic or requests. Services may be interrupted, users may
online banking: experience inconvenience, and there may be a chance for
more security breaches [95], [108], [109].
1) MALWARE ATTACKS
Malware poses a significant threat to online banking systems. 8) WEAK PASSWORDS
Attackers can use malicious software to gain unauthorized Because they are simple to guess or crack, weak passwords
access to systems. Malware can be utilized to hijack put online banking security at risk. Due to this, they can more
sessions, steal passwords, and even set keyloggers on victims’ easily breach sensitive data, access user accounts without
machines [91], [94], [95], [103], [104]. authorization, and engage in fraudulent activity [8], [96].

2) SESSION HIJACKING 9) SQL INJECTION

The act of gaining unauthorized access to a user’s session so In a SQL injection attack, malicious code is inserted into
that an attacker can exploit the user’s identity and access their strings before being sent to a SQL database for execution.
online bank account is referred to as ‘‘session hijacking.’’ Via Users’ credentials, such as usernames and passwords, can be
network connection interception or the use of vulnerabilities, taken by using SQL injection. This can then be used to access
attackers can carry out illegal activities or acquire private data user accounts without authorization [110], [111].
[99], [100], [105].
10) REPLAY ATTACK
3) KEYLOGGERS
Replay attacks are a type of MiTM attack where an attacker
Malicious software that records your keystrokes is called captures a legitimate authentication request and resends it
a keylogger. Your username, password, and other private later. This can be done to gain unauthorized access to an
information that you type into your computer will all be online banking account [112], [113], [114].
recorded by the keylogger. There are several ways that Knowing that the above attacks could target the supply
keyloggers can get onto your computer: via opening a chain & third-party or endpoint of online banking systems,
compromised attachment, clicking on a malicious link, supply chain attacks occur when attackers gain access
or downloading a file from an untrusted source. Once to systems through external sources, such as third-party
installed on your computer, a keylogger can give the hacker software or vendors [101]. Hackers exploit vulnerabilities
access to your data [54], [88]. in these systems to compromise online banking security,
potentially leading to data breaches or unauthorized access.
4) SOCIAL ENGINEERING Additionally, endpoint attacks specifically target the user’s
Social engineering is the practice of coercing someone into device or endpoint. Attackers aim to gain access to sensitive
disclosing private information or taking activities that com- banking information stored on the user’s device, potentially
promise the security of their online bank accounts. Attackers leading to financial fraud or unauthorized transactions [74].
fool users by using strategies like urgency, impersonation, and Table 6, Summarizes the above threats and provides the
trust-building [92], [106]. potential countermeasures that could be applied to prevent
them:
5) PHISHING ATTACKS Implementing the controls mentioned in the above table
Phishing attacks are a form of social engineering in which the is essential for financial institutions to protect their online
attackers attempt to get confidential data from the target, such banking systems and ensure users’ financial information
as financial information or login credentials. Usually, this security. By adopting a comprehensive approach that includes
is accomplished by using phoney emails, texts, or websites technological measures (e.g., firewall, antivirus), user educa-
that impersonate reputable websites. Once a user gives tion (e.g., awareness, training), policies (e.g., security & pri-
personal information, the attacker can exploit it to access vacy policies, password policy) and continuous monitoring,
that user’s online banking account without authorization financial institutions can mitigate threats and create a more
[86], [107]. secure online banking environment.

VOLUME 12, 2024 747

 N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

TABLE 4. User authentication methods of online banking.

748 VOLUME 12, 2024

N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

FIGURE 3. Frequency of authentication methods in MFA and 2FA contexts.

C. OVERVIEW OF USER AUTHENTICATION METHODS IN security that many banks employ. Clients who sign in using
LEADING BANKS a new device are sent a unique OTP password via SMS or
This subsection answers RQ3: ‘‘What are current user email. This code must be input to increase further security to
authentication methods used by well-known banks world- complete the login procedure. Because a one-time password
wide?’’. Studying user authentication methods employed by is only suitable for one login session and has a short validity
global banks holds significant importance in understanding period, there is little chance it will be intercepted or used
the evolving landscape of online banking security. The user again. As previously mentioned, physiological biometric
authentication methods employed by selected banks are identification is becoming increasingly popular among banks
summarized in Table 7. The table illustrates the different as a more secure alternative to passwords. Customers’
methods of authentication that banks use to guarantee secure identities are verified using this technology, which uses
access to their online banking platforms. distinctive physical traits like fingerprints and facial recog-
The information in Table 7 reveals the user authentication nition. It is difficult to impersonate vital data, which makes
strategies used by several well-known financial institutions, it an effective way to prevent unauthorized access. These
including HSBC Holdings plc, CIMB Bank, Bank of Amer- banks frequently employ 2FA as a security measure. When
ica, Bank of China (BOC), JPMorgan Chase & Co., Citigroup logging in from a new device, users must supply a second
Inc., Barclays plc, and Arab bank. These financial institutions security factor besides their passwords, such as an OTP
use various authentication techniques because they value or biometric information. Due to the additional layer of
keeping their customers’ online accounts secure. One of security provided by 2FA, it is far more challenging for
the common authentication methods used by these banks attackers to access consumer accounts without authorization.
is the password. Customers must create strong passwords Some banks also provide other authentication options such
that follow specific standards (e.g., NIST password policy), as USB security keys, security questions, challenge/response,
such as being at least eight characters long and combining voiceprint authentication, and device fingerprints. Device
uppercase and lowercase letters, numbers, and symbols. fingerprints help identify which devices have been used
A crucial security measure is using passwords, which act by the user, whereas voiceprint authentication employs the
as the first layer of defense against unauthorized access. unique characteristics of a person’s voice. Entering a code
One-time password (OTP) authentication is another type of produced by the bank and transmitted to the customer’s

VOLUME 12, 2024 749

 N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

TABLE 5. User authentication methods used by authors.

mobile device is required for the challenge/response. When passwords, from being intercepted (MiTM Attacks) or taken
used in online banking to raise limitations for specific sorts by cyber-attackers, cryptography is utilized. Additionally,
of transfers, a USB security key functions as an additional transactions and users are authenticated using cryptography
layer of security and plugs into the USB port on your to make sure that only authorized users have access to
computer. Customers are prompted to respond to pre-selected their accounts and that all transactions are legitimate [124].
questions as part of the login process to add an extra layer of Examples of encryption techniques used today by banks
authentication known as security questions. It should be noted to protect the user credential while transmitted and stored
that these banks regularly review and update their security include public key encryption algorithms (i.e., asymmet-
measures to stay ahead of emerging threats and protect ric cryptography) such as RSA (Rivest-Shamir-Adleman),
their customers’ accounts. They also provide educational Diffie-Hellman and ECC (Elliptic Curve Cryptography) and
resources to help customers understand the importance of symmetric encryption algorithms such as AES (Advanced
security and how to protect themselves from fraud. Encryption Standard). These algorithms are considered very
secure, and it will take a very long time to break them
V. CHALLENGES FACING ONLINE BANKING USER
using today’s computing capabilities [125]. However, the
AUTHENTICATION
emergence of quantum poses a serious risk to user authen-
The future of online banking user authentication techniques
tication for online banking. The term ‘‘quantum’’ refers to
and cyber threats is unclear, but the stakes are enor-
the use of quantum computers, which are technological tools
mous [123]. Financial institutions can protect their consumers
that can carry out calculations based on quantum physics
and ensure the continuous expansion of online banking by
concepts like superposition and entanglement [126]. Some
staying on top of the most recent trends. By addressing
issues could be solved by quantum computers far more
these challenges, financial institutions can help ensure online
quickly than by traditional computers. Many of the current
banking systems’ security in the years to come. The following
encryption algorithms, particularly those used to safeguard
are some challenges that should be considered to improve the
online banking passwords, could be broken by quantum
security and user authentication process of online banking
computers [127], [128]. Banks and other financial institutions
systems:
may utilize post-quantum cryptography to safeguard online
A. QUANTUM COMPUTING CHALLENGE banking user authentication against quantum attacks. Post-
User authentication for online banking relies heavily on cryp- quantum cryptography refers to a form of cryptographic
tography. To prevent user credentials, such as usernames and technique specifically engineered to withstand attacks carried

750 VOLUME 12, 2024

N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

TABLE 6. Online banking user authentication threats.

out using quantum computers. Post-quantum cryptography be challenging for quantum computers to solve. A project
is essential in safeguarding user credentials against potential to standardize post-quantum cryptography was begun by
compromise by a cryptanalytically relevant quantum com- the National Institute of Standards and Technology (NIST)
puter (CRQC) [129]. The public-key encryption algorithms in 2016 to identify and compare the top contenders for
now used to protect most digital systems can be broken post-quantum encryption algorithms. NIST released the first
by CRQCs, which are quantum computers with sufficient quartet of four algorithms in 2022, marking the beginning of
processing capacity. A CRQC might seriously compromise its post-quantum encryption standard. In around two years,
sensitive communications, transactions, and infrastructure, the standard should be completed. The standard’s objective is
which would put many nations’ economic and national to safeguard online banking and other digital services in the
security at risk. To prevent assaults from either a CRQC future from potential quantum attacks [127], [129]. In addi-
or a traditional computer, post-quantum cryptography must tion to using post-quantum cryptography, the MFA method
be created and put into use. Post-quantum cryptography is can be used by banks and other financial institutions to reduce
a kind of encryption built to withstand quantum attacks. the risk of quantum attacks [128]. By implementing post-
It makes use of mathematical puzzles that are thought to quantum cryptography, MFA and other quantum-resistant

VOLUME 12, 2024 751

 N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

TABLE 7. User authentication methods employed in selected banks.

technologies, banks and other financial institutions can help be used to create phishing emails and websites that are
protect their customers’ accounts and transactions from more convincing and likely to trick users [140], [141].
future quantum attacks. However, banks can also utilize ML to strengthen their
systems’ security and resilience while defending them against
B. ARTIFICIAL INTELLIGENCE CHALLENGE cyberattacks. Banks may improve their risk management and
Online banking could be put at risk if cyber-attackers employ compliance procedures as well as detect and stop fraud,
artificial intelligence (AI), especially machine learning (ML), malware, phishing, and other risks with the aid of ML.
to breach digital networks or get past detection mechanisms Therefore, depending on how it is applied and managed,
[130], [131], [132], [133]. Several approaches could be ML may both provide a threat and a chance for online
utilized to compromise online banking user authentication banking [142], [143].
using ML.
• Deep fakes can be produced, for instance, using ML. C. USER PRIVACY CHALLENGE
Deepfakes are manufactured works of art where the User authentication in online banking that relies on BBA
likeness of another person is used to substitute a (e.g., Fingerprint) is extremely safe and practical because it
person in an already-existing photograph or video. is considerably more challenging to fake or steal biometric
When people register into their online banking accounts, data. BBA, however, is also accompanied by some privacy
phony movies of them doing so might be made using issues [131], [144]. For instance, if a bank’s biometric
deepfakes, which could then be used to steal their login database is breached, hackers may have access to all of the
information [134], [135], [136]. bank’s clientele’s biometric information. Some people are
• ML may be used to attack vulnerabilities in authentica- also concerned about their biometric data being collected
tion systems driven by AI. Though they are still under and stored by the banks or other groups [42]. It is the
development, AI-powered authentication solutions are duty of banks using BBA to safeguard the privacy of the
becoming more widespread. AI could be employed to biometric information about their clients. This entails taking
identify and take advantage of these systems’ flaws to precautions to shield the data against unlawful use, access,
access users’ accounts [133], [137], [138]. or disclosure. Additionally, banks must have a privacy policy
• Online banking system attacks could be automated in place that describes to clients how their biometric data will
using ML. Attacks on online banking systems, such as be used.
guessing attacks, brute-force attacks, and DoS attacks,
could be automated with the help of ML techniques. D. SYSTEM COMPATIBILITY CHALLENGE
Attackers may find it simpler to mount effective assaults Banks may need to modify their current systems and proce-
against online banks as a result [133], [139]. Also, dures to accommodate the use of a variety of authentication
Phishing attacks may be launched using ML. Phishing techniques, such as biometrics, Token, MFA, etc., for online
attacks aim to deceive users into disclosing sensitive data banking user authentication. also, if a merchant utilizes
like credit card numbers or login credentials. AI might third-party payment or billing services, they may need

752 VOLUME 12, 2024

N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

to confirm that these services are appropriate for online because if the attacker compromises one layer, the rest of
banking user authentication and can support the necessary the layers will protect the system. Moreover, The study also
authentication procedures [145], [146]. covered several cyber threats that can harm online banking
systems and explored ways to get over user authentication’s
E. SYSTEM USABILITY CHALLENGE protective measures. Among these threats are malware
A well-known problem in the area of user authentication is attacks, social engineering, phishing attacks, middleman
the trade-off between security and usability. For example, attacks, denial of service attacks, session hijacking, weak
one strategy for improving user authentication security is passwords, keyloggers, SQL injection, and replay attacks.
layering. It entails using several levels of authentication, In addition, the study explored various well-known banks’
which may use a variety of authentication techniques, methods for user authentication, which can offer insights into
including biometrics, passwords, and security tokens (i.e., the best ways to secure online bank accounts. By discussing
MFA). The premise behind layering is that if one layer the advantages and disadvantages of user authentication
of security is breached, there will still be other layers of methods used in online banking, the research shows that MFA
protection in place to keep unauthorized users from accessing will become increasingly popular in online banking systems
the system [4], [73], [147]. So that, layering is that as for the degree of security it provides to user accounts. The
the number of layers increases, the security of the system paper also showed that biometric authentication methods,
improves, but the usability decreases. This is Because the whether physiological or behavioral, will play a large and
authentication procedure becomes more complex with each increasing role in the security of online banking services
new layer, users may become frustrated and confused as to the point. The challenges that should be considered to
a result. On the other side, fewer layers can simplify and improve the security and user authentication process of online
improve the usability of the authentication process, but the banking systems include quantum computing, AI, privacy,
level of security is also compromised [4]. It is important system compatibility, and system usability. A limitation of
to balance security and usability, so users need to select this paper is that it relied on a literature review of online bank
authentication methods that are suitable for the necessary account authentication and did not include digital wallet user
security level [12]. authentication and blockchain authentication. Future research
should include authentication methods for e-wallets as well as
VI. CONCLUSION AND FUTURE DIRECTIONS the use of blockchain technology to authenticate users. This
This research conducted an SLR regarding authentication paper’s findings will interest many stakeholders, including
methods for users in online banks over ten years (2013-2023), financial institutions, government agencies, and researchers.
where it was found that banks utilize various authentica- The findings will help develop new security measures and
tion methods to online banking systems to protect user educational resources to protect online banking users from
accounts from unauthorized access. Online banking user cyber threats.
authentication methods are divided into four categories:
KBA, BBA, PBA, and other methods. Each category CONFLICT OF INTERESTS
includes a variety of authentication methods with varying The authors declare no conflict of interest.
strengths, weaknesses, and implementation considerations.
KBA methods rely on user knowledge, such as passwords, DATA AVAILABILITY STATEMENT
PINs, and security questions, to verify their identity. BBA The data presented in this study are available in the article.
methods employ unique physiological biometrics (such as
fingerprint and face ID) and behavioral biometrics (including REFERENCES
voice patterns, keystroke dynamics, and tapping behavior) [1] S. Fox. (2013). 51% of US Adults Bank Online. Pew Research Center
to confirm users’ identities. PBA methods require users to Washington, DC, USA. Accessed: Feb. 24, 2019. [Online]. Available:
have a token or physical device to access their accounts, https://core.ac.uk/download/pdf/71362506.pdf
such as OTP authentication that generates temporary and [2] S. Ahmad, ‘‘Demonetization-its impact on banking online transactions,’’
Sumedha J. Manag., vol. 6, no. 3, pp. 4–15, 2017. [Online]. Available:
exclusive authentication codes delivered through SMS to http://search.proquest.com/openview/80b340c087f8285fb81ec91b55e13
the user’s phone, security keys/USB, OffPAD, and wear- 64a/1?pq-origsite=gscholar&cbl=1936345
able devices. Other methods involve various authentication [3] H. A. Abdeljaber, ‘‘Automatic Arabic short answers scoring using longest
common subsequence and Arabic WordNet,’’ IEEE Access, vol. 9,
procedures that do not fit neatly into the KBA, BBA, pp. 76433–76445, 2021.
or PBA categories. Examples include MAC addresses, [4] N. A. Karim, Z. Shukur, and A. M. Al-Banna, ‘‘UIPA: User authentication
IMEI numbers, IP addresses, geolocation, CAPTCHAs, method based on user interface preferences for account recovery
process,’’ J. Inf. Secur. Appl., vol. 52, Jun. 2020, Art. no. 102466.
FIDO, and QR codes. 2FA and MFA frameworks combine
[5] N. Harini and T. Padmanabhan, ‘‘2CAuth: A new two factor authen-
different authentication methods from various categories to tication scheme using QR-code,’’ Int. J. Eng. Technol., vol. 5,
significantly improve security. By combining several types no. 2, pp. 1087–1094, 2013. [Online]. Available: http://citeseerx.ist.
psu.edu/viewdoc/download?doi=10.1.1.411.9555&rep=rep1&type=pdf
of authentication methods, banks can significantly improve
[6] A. Ometov, S. Bezzateev, N. Mäkitalo, S. Andreev, T. Mikkonen, and
the security of their systems and create a layered security Y. Koucheryavy, ‘‘Multi-factor authentication: A survey,’’ Cryptography,
approach that is difficult for attackers to crack. This is vol. 2, no. 1, pp. 1–22, Jan. 2018.

VOLUME 12, 2024 753

 N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

[7] N. A. Karim, H. Kanaker, S. Almasadeh, and J. Zarqou, ‘‘A robust user [31] S. Nagaraju and L. Parthiban, ‘‘Trusted framework for online banking
authentication technique in online examination,’’ Int. J. Comput., vol. 20, in public cloud using multi-factor authentication and privacy protection
no. 4, pp. 535–542, Dec. 2021. gateway,’’ J. Cloud Comput., vol. 4, no. 1, p. 22, Dec. 2015. [Online].
[8] N. A. Karim and Z. Shukur, ‘‘Using preferences as user identification in Available: http://www.journalofcloudcomputing.com/content/4/1/22
the online examination,’’ Int. J. Adv. Sci., Eng. Inf. Technol., vol. 6, no. 6, [32] P. C. Mondal, R. Deb, and M. N. Huda, ‘‘Transaction authorization from
p. 1026, Dec. 2016. know your customer (KYC) information in online banking,’’ in Proc. 9th
[9] M. K. Normalini and T. Ramayah, ‘‘A proposed biometrics technologies Int. Conf. Elect. Comput. Eng., 2016, pp. 523–526. [Online]. Available:
implementation in Malaysia internet banking services,’’ in Proc. 13th http://ieeexplore.ieee.org/document/7853972/
Eurasia Bus. Econ. Soc. Conf., vol. 1, 2015, pp. 79–87. [Online]. Avail- [33] B. Akoramurthy and J. Arthi, ‘‘GeoMoB—A geo location based browser
able: https://link.springer.com/chapter/10.1007/978-3-319-15880-8_7 for secured mobile banking,’’ in Proc. 8th Int. Conf. Adv. Comput.
[10] E. Pakulova, A. Ryndin, and O. Basov, ‘‘Multi-path multimodal authen- (ICoAC), Jan. 2017, pp. 83–88.
tication system for remote information system,’’ in Proc. 12th Int. Conf. [34] A. Alhothaily, C. Hu, A. Alrawais, T. Song, X. Cheng, and D. Chen,
Secur. Inf. Netw., Sep. 2019, pp. 1–4, doi: 10.1145/3357613.3357640. ‘‘A secure and practical authentication scheme using personal devices,’’
[11] R. D. Silva, ‘‘Calls for behavioural biometrics as bank fraud soars,’’ IEEE Access, vol. 5, pp. 11677–11687, 2017. [Online]. Available:
Biometric Technol. Today, vol. 2021, no. 9, pp. 7–9, Sep. 2021. http://ieeexplore.ieee.org/document/7954590/
[12] N. A. Karim and Z. Shukur, ‘‘Review of user authentication methods in [35] A. Sheshasaayee and D. Sumathy, ‘‘A framework to enhance security
online examination,’’ Asian J. Inf. Technol., vol. 14, no. 5, pp. 166–175, for OTP SMS in e-banking environment using cryptography and text
2015. steganography,’’ in Proc. Int. Conf. Data Eng. Commun. Technol.,
[13] F. Sinigaglia, R. Carbone, G. Costa, and N. Zannone, ‘‘A survey on multi- vol. 469, 2017, pp. 709–717.
factor authentication for online banking in the wild,’’ Comput. Secur., [36] B. K. Alese, A. F.-B. Thompson, O. D. Alowolodu, and
vol. 95, Aug. 2020, Art. no. 101745. B. E. Oladele, ‘‘Multilevel authentication system for stemming crime
[14] O. A. Hassan, A. Samhan, S. Alhajhassan, and R. Hammad, ‘‘ARivaT: in online banking,’’ Interdiscipl. J. Inf., Knowl., Manag., vol. 13,
A tool for automated generation of Riva-based business process pp. 79–94, Jan. 2018. [Online]. Available: http://www.ijikm.org/
architecture diagrams,’’ IEEE Access, vol. 11, pp. 46257–46270, 2023. Volume13/IJIKMv13p079-094Alese4509.pdf
[37] M. Bartlomiejczyk, E. F. Imed, and M. Kurkowski, ‘‘Multifactor
[15] M. A. Hassan, Z. Shukur, M. K. Hasan, and A. S. Al-Khaleefa, ‘‘A review
authentication protocol in a mobile environment,’’ IEEE Access, vol. 7,
on electronic payments security,’’ Symmetry, vol. 12, no. 8, p. 1344, 2020.
pp. 157185–157199, 2019.
[16] Z. Wang and H. Xing, ‘‘A kind of rational preference,’’ in Proc. 9th IEEE
[38] K. Chatterjee, ‘‘Continuous user authentication system: A risk analysis
Int. Conf. Cognit. Informat. (ICCI), Jul. 2010, pp. 754–759.
based approach,’’ Wireless Pers. Commun., vol. 108, no. 1, pp. 281–295,
[17] S. Kiljan, K. Simoens, D. D. E. Cock, M. V. A. N. Eekelen, and
Sep. 2019.
H. Vranken, ‘‘A survey of authentication and communications security,’’
[39] A. T. Kiyani, A. Lasebae, K. Ali, and M. Ur-Rehman, ‘‘Secure
ACM Comput., vol. 49, no. 4, pp. 1–35, 2016. [Online]. Available:
online banking with biometrics,’’ in Proc. Int. Conf. Adv. Emerg.
http://dl.acm.org/citation.cfm?id=3002170
Comput. Technol. (AECT), Feb. 2020, pp. 1–6. [Online]. Available:
[18] C. Wang, Y. Wang, Y. Chen, H. Liu, and J. Liu, ‘‘User authentication https://ieeexplore.ieee.org/abstract/document/9194214/
on mobile devices: Approaches, threats and trends,’’ Comput. Netw., [40] Z. P. Zwane, T. E. Mathonsi, and S. P. Maswikaneng, ‘‘An intelligent
vol. 170, Apr. 2020, Art. no. 107118. security model for online banking authentication,’’ in Proc. IST-Africa
[19] O. M. Ogbanufe and C. Baham, ‘‘Using multi-factor authentication for Conf., 2021, pp. 1–6.
online account security: Examining the influence of anticipated regret,’’ [41] G. L. Moepi and T. E. Mathonsi, ‘‘Multi-factor authentication method
Inf. Syst. Frontiers, vol. 25, no. 2, pp. 897–916, Apr. 2022. for online banking services in South Africa,’’ in Proc. Int. Conf. Elect.,
[20] N. A. Karim, W. K. Abdulraheem, H. Kanaker, F. I. Alzobi, Z. Shukur, Comput. Energy Technol., 2021, pp. 1–5.
O. Qtaish, and M. Abuhamdeh, ‘‘Using interface preferences as evidence [42] S. L. Sahdev, S. Singh, N. Kaur, and L. Siddiqui, ‘‘Behavioral biometrics
of user identity: A feasibility study,’’ Int. J. Data Netw. Sci., vol. 8, no. 1, for adaptive authentication in digital banking—Guard against flawless
pp. 537–548, 2024. privacy,’’ in Proc. Int. Conf. Innov. Practices Technol. Manag., 2021,
[21] N. A. Karim, H. Kanaker, W. K. Abdulraheem, M. A. Ghaith, pp. 261–265.
E. Alhroob, and A. M. F. Alali, ‘‘Choosing the right MFA method for [43] W. A. Hammood, R. A. Arshah, S. M. Asmara, and O. A. Hammood,
online systems: A comparative analysis,’’ Int. J. Data Netw. Sci., vol. 8, ‘‘User authentication model based on mobile phone IMEI number:
no. 1, pp. 201–212, 2024. A proposed method application for online banking system,’’ in Proc. Int.
[22] S. Kiljan, K. Simoens, D. D. Cock, M. V. Eekelen, and H. Vranken, Conf. Softw. Eng. Comput. Syst. 4th Int. Conf. Comput. Sci. Inf. Manag.
‘‘A survey of authentication and communications security in online (ICSECS-ICOCSIM), Aug. 2021, pp. 411–416.
banking,’’ ACM Comput. Surv., vol. 49, no. 4, pp. 1–35, Dec. 2017. [44] C. U. Bah, A. H. Seyal, and U. Yahya, ‘‘Combining pin and biometric
[23] S. Kiljan, H. Vranken, and M. van Eekelen, ‘‘Evaluation of transaction identifications as enhancement to user authentication in internet bank-
authentication methods for online banking,’’ Future Gener. Comput. Syst., ing,’’ in Proc. 7th Brunei Int. Conf. Eng. Technol., 2021, pp. 1—8.
vol. 80, pp. 430–447, Mar. 2018. [45] F. Pirzado, S. Memon, L. D. D. Dhomeja, and A. Ahmed, ‘‘Keystroke
[24] W. A. Hammood, R. Abdullah, O. A. Hammood, S. M. Asmara, dynamics based technique to enhance the security in smart devices,’’
M. A. Al-Sharafi, and A. M. Hasan, ‘‘A review of user authentication KIET J. Comput. Inf. Sci., vol. 4, no. 1, p. 14, Jan. 2021.
model for online banking system based on mobile IMEI number,’’ IOP [46] A. Ara, A. Sharma, and D. Yadav, ‘‘An efficient privacy-preserving
Conf. Ser., Mater. Sci. Eng., vol. 769, no. 1, 2020, Art. no. 012061. user authentication scheme using image processing and blockchain
[25] P. Aithal, ‘‘A review on advanced security solutions in online banking technologies,’’ J. Discrete Math. Sci. Cryptography, vol. 25, no. 4,
models,’’ Int. J. Sci. Res. Modern Educ. (IJSRME), vol. 1, pp. 421–429, pp. 1137–1155, May 2022.
Jun. 2016. [47] S. Hublikar, V. B. Pattanashetty, V. Mane, P. S. Pillai, M. Lakkannavar,
[26] S. W. Shah and S. S. Kanhere, ‘‘Recent trends in user authentication—A and N. S. Shet, ‘‘Biometric-based authentication in online banking,’’ in
survey,’’ IEEE Access, vol. 7, pp. 112505–112519, 2019. Information and Communication Technology for Competitive Strategies
[27] S. Keele. (2007). Guidelines for Performing Systematic Literature (Lecture Notes in Networks and Systems), vol. 400. Singapore: Springer,
Reviews in Software Engineering. [Online]. Available: http://www. 2023, pp. 249–259, doi: 10.1007/978-981-19-0095-2_26.
academia.edu/download/35830450/2_143465389588742151.pdf [48] M. K. Abiodun, J. B. Awotunde, A. E. Adeniyi, D. Ademuagun,
[28] K. Takatori, ‘‘Mendeley; Reference manager,’’ Kyokai Joho Imeji and D. R. Aremu, ‘‘Securing digital transaction using a three-level
Zasshi/J. Inst. Image Inf. Telev. Eng., vol. 70, pp. 320–323, 2016. authentication system,’’ in Computational Science and Its Applications—
[29] S. Shamal, K. Monika, and N. Neha, ‘‘Secure authentication for online ICCSA (Lecture Notes in Computer Science), vol. 13380. Springer, 2022,
banking using QR code,’’ IJETAE-Int. J. Emerg. Technol. Advance Eng., pp. 135–148, doi: 10.1007/978-3-031-10542-5_10.
Mar. 2014. [49] A. Renz, T. Neff, M. Baldauf, and E. Maier, ‘‘Authentication methods for
[30] A. Plateaux, P. Lacharme, A. Jøsang, and C. Rosenberger. (2014). One- voice services on smart speakers—A multi-method study on perceived
Time Biometrics for Online Banking Electron, Payment Authentication. security and ease of use,’’ I-COM, vol. 22, pp. 67–81, Apr. 2023. [Online].
[Online]. Available: http://link.springer.com/10.1007/978-3-319-10975- Available: https://www.degruyter.com/document/doi/10.1515/icom-
6_14 2022-0039/html

754 VOLUME 12, 2024

N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

[50] D. Sulistyowati, F. Handayani, and Y. Suryanto, ‘‘Comparative analysis [69] N. Kheshaifaty and A. Gutub, ‘‘Engineering graphical captcha
and design of cybersecurity maturity assessment methodology using nist and AES crypto hash functions for secure online authentication,’’
csf, cobit, ISO/IEC 27002 AND PCI DSS,’’ Int. J. Inform. Vis., vol. 4, J. Eng. Res., Nov. 2021. [Online]. Available: https://kuwaitjournals.
no. 4, pp. 225–230, 2020. org/jer/index.php/JER/article/view/13761
[51] S. Jarecki, M. Jubur, H. Krawczyk, N. Saxena, and M. Shirvanian, [70] K. Wong and M. H. Kim, ‘‘An enhanced user authentication solution for
‘‘Two-factor password-authenticated key exchange with end-to-end mobile payment systems using wearables,’’ Secur. Commun. Netw., vol. 9,
security,’’ ACM Trans. Privacy Secur., vol. 24, no. 3, pp. 1–37, no. 17, pp. 4639–4649, Nov. 2016.
Aug. 2021. [71] L. Zhang. (2018). Smartphone App Security: Vulnerabilities
[52] B. Bhana and S. Flowerday, ‘‘Passphrase and keystroke dynamics and Implementations. [Online]. Available: https://deepblue.
authentication: Usable security,’’ Comput. Secur., vol. 96, Sep. 2020, lib.umich.edu/handle/2027.42/143522
Art. no. 101925. [72] S. Sciancalepore, S. Raponi, D. Caldarola, and R. D. Pietro, ‘‘Fractal:
[53] Y. S. Chuen, M. Al-Rashdan, and Q. Al-Maatouk, ‘‘Graphical password Single-channel multi-factor transaction authentication through a compro-
strategy,’’ J. Crit. Rev., vol. 7, pp. 102–104, Jan. 2020. mised terminal,’’ in Information and Communications Security (Lecture
[54] M. Verma, R. Sawhney, and R. Chalia, ‘‘Biometric based user authentica- Notes in Computer Science), vol. 13407. Springer, 2022, pp. 201–217,
tion in smart phones,’’ in Proc. Int. Conf. Next Gener. Comput. Inf. Syst. doi: 10.1007/978-3-031-15777-6_12.
(ICNGCIS), Dec. 2017, pp. 183–188. [73] D. Cherry, ‘‘Multi-factor authentication,’’ in Enterprise-Grade IT Secu-
[55] A. G. Johansen, ‘‘Biometrics and biometric data: What is it and is it rity for Small and Medium Businesses: Building Security Systems,
secure?’’ IEEE, Tech. Rep., 2019. in Plain English. Berkeley, CA, USA: Apress, 2022, pp. 83–96, doi:
[56] V. Jancok and M. Ries, ‘‘Security aspects of behavioral biometrics 10.1007/978-1-4842-8628-9_7.
for strong user authentication,’’ in Proc. Int. Conf. Comput. [74] A. Q. Stanikzai and M. A. Shah, ‘‘Evaluation of cyber security threats
Syst. Technol., Jun. 2022, pp. 57–63. [Online]. Available: in banking systems,’’ in Proc. IEEE Symp. Ser. Comput. Intell. (SSCI),
https://dl.acm.org/doi/10.1145/3546118.3546152 Dec. 2021, pp. 1–4.
[57] M. Stokkenes, R. Ramachandra, and C. Busch, ‘‘Biometric transaction [75] K. Malinka, O. Hujnák, P. Hanácek, and L. Hellebrandt, ‘‘E-
authentication using smartphones,’’ in Proc. Int. Conf. Biometrics Special banking security study—10 years later,’’ IEEE Access, vol. 10,
Interest Group (BIOSIG), Sep. 2018, pp. 1–5. pp. 16681–16699, 2022.
[58] A. Sarkar and B. K. Singh, ‘‘A review on performance, security and var- [76] M. Alshinwan, A. Y. Shdefat, N. Mostafa, A. A. M. AlSokkar,
ious biometric template protection schemes for biometric authentication T. Alsarhan, and D. Almajali, ‘‘Integrated cloud computing and
systems,’’ Multimedia Tools Appl., vol. 79, nos. 37–38, pp. 27721–27776, blockchain systems: A review,’’ Int. J. Data Netw. Sci., vol. 7, no. 2,
Oct. 2020. pp. 941–956, 2023.
[59] Y. W. Chow, W. Susilo, G. Yang, M. H. Au, and C. Wang, ‘‘Authentication [77] D. Choi, D. Tak, and I. Chung, ‘‘Secure password-based authentication
and transaction verification using QR codes with a mobile device,’’ in method for mobile banking services,’’ J. Korea Multimedia Soc., vol. 19,
Security, Privacy, and Anonymity in Computation, Communication, and no. 1, pp. 41–50, Jan. 2016.
Storage (Lecture Notes in Computer Science), vol. 10066. Zhangjiajie, [78] M. A. Hassan, Z. Shukur, and M. K. Hasan, ‘‘Electronic wallet payment
China: Springer, 2016, pp. 437–451, doi: 10.1007/978-3-319-49148- system in Malaysia,’’ Lect. Notes Data Eng. Commun. Technol., vol. 54,
6_36. pp. 711–736, 2021.
[60] M. H. Eldefrawy, K. Alghathbar, and M. K. Khan, ‘‘OTP-based two-factor [79] A. Renz, M. Baldauf, E. Maier, and F. Alt, ‘‘Alexa, it’s me! An
authentication using mobile phones,’’ in Proc. 8th Int. Conf. Inf. Technol., online survey on the user experience of smart speaker authenti-
New Gener., 2011, pp. 327–331. cation,’’ in Proc. ACM Int. Conf., vol. 22, 2022, pp. 14–24, doi:
[61] E. O. Vinbæk, F. M. B. Pettersen, J. E. Carlsen, K. Fremstad, N. Edvinsen, 10.1145/3543758.3543765.
and F. E. Sandnes, ‘‘On online banking authentication for all: A [80] R. Batie Jr., Y. Levy, S. Furnell, and P. Liu, ‘‘Improving user authenti-
comparison of bankid login efficiency using smartphones versus code cation with fingerprint biometrics and biometric personal identification
generators,’’ in Proc. Int. Conf. Human-Comput. Interact., vol. 11572, number (BIO-PINTM) as a multi-factor authentication mechanism,’’
2019, pp. 365–374. Tech. Rep., 2015.
[62] P. Nandi and D. P. Savant, ‘‘Graphical password authentication system,’’ [81] S. K. A. Kumar, G. V. Ihita, S. Chaudhari, and P. Arumugam, ‘‘A survey
Int. J. Res. Appl. Sci. Eng. Technol., vol. 10, no. 4, pp. 1759–1765, on rural internet connectivity in India,’’ in Proc. 14th Int. Conf. Commun.
Apr. 2022. Syst. Netw., 2022, pp. 911–916.
[63] M. Alhaidary, S. M. M. Rahman, M. Zakariah, M. S. Hossain, [82] F. Ebbers and P. Brune, ‘‘The authentication game—Secure user
A. Alamri, M. S. M. Haque, and B. B. Gupta, ‘‘Vulnerability analysis authentication by gamification?’’ in Proc. Int. Conf. Adv. Inf. Syst. Eng.,
for the authentication protocols in trusted computing platforms and a vol. 9694, 2016, pp. 101–115.
proposed enhancement of the OffPAD protocol,’’ IEEE Access, vol. 6, [83] R. AlHusain and A. Alkhalifah, ‘‘Evaluating fallback authentication
pp. 6071–6081, 2018. research: A systematic literature review,’’ Comput. Secur., vol. 111,
[64] M. E. Farfoura, O. A. Khashan, H. Omar, Y. Alshamaila, N. A. Karim, Dec. 2021, Art. no. 102487.
H.-T. Tseng, and M. Alshinwan, ‘‘A fragile watermarking method [84] K. Skracic, P. Pale, and B. Jeren, ‘‘Question based user authentication
for content-authentication of H. 264-AVC video,’’ J. Internet in commercial environments,’’ in Proc. 37th Int. Conv. Inf. Commun.
Services Inf. Secur., vol. 13, no. 2, pp. 211–232, 2023. [Online]. Technol., Electron. Microelectron. (MIPRO), May 2014, pp. 1422–1427.
Available: https://www.scopus.com/inward/record.uri?eid=2-s2.0- [85] A. D. Rubin, ‘‘Taking two-factor to the next level: Protecting online
85162828477&doi=10.58346%2fJISIS.2023.I2.014&partnerID=40&md poker, banking, healthcare and other applications,’’ in Proc. 30th Annu.
5=849a4d9a7175429406e4d7963b3ea966, doi: 10.58346/JISIS.2023. Comput. Secur. Appl. Conf., Dec. 2014, pp. 1–5, doi: 10.1145/2664243.
I2.014. 2684461.
[65] M. A. Hassan and Z. Shukur, ‘‘Device identity-based user authentication [86] D. Migdal, C. Johansen, and A. Jøsang, ‘‘DEMO: OffPAD-offline
on electronic payment system for secure E-wallet apps,’’ Electronics, personal authenticating device with applications in hospitals and e-
vol. 11, no. 1, p. 4, Dec. 2021. banking,’’ in Proc. ACM SIGSAC Conf. Comput. Commun. Secur.,
[66] N. Akhtar and F. U. Haq, ‘‘Real time online banking fraud detection using Oct. 2016, pp. 1847–1849, doi: 10.1145/2976749.2989033.
location information,’’ in Proc. Int. Conf. Comput. Intell. Inf. Technol., [87] X. Wang, Z. Yan, R. Zhang, and P. Zhang, ‘‘Attacks and defenses in
vol. 250, 2011, pp. 770–772, doi: 10.1007/978-3-642-25734-6_136. user authentication systems: A survey,’’ J. Netw. Comput. Appl., vol. 188,
[67] K. R. J. Joshi. (2016). Security Analysis and Comparison of Aug. 2021, Art. no. 103080.
Nepalese Internet Banking Web Applications. [Online]. Available: [88] A. Bani-Hani, M. Majdalweieh, and A. AlShamsi, ‘‘Online authentication
https://elibrary.tucl.edu.np/handle/123456789/7902 methods used in banks and attacks against these methods,’’ Proc. Comput.
[68] M. Hijjawi, M. A. Shinwan, M. H. Qutqut, W. Alomoush, O. A. Khashan, Sci., vol. 151, pp. 1052–1059, Jan. 2019.
M. Alshdaifat, A. Alsokkar, and L. Abualigah, ‘‘Improved flat [89] C. Yoo, B.-T. Kang, and H. K. Kim, ‘‘Case study of the vulnerability
mobile core network architecture for 5G mobile communication of OTP implemented in internet banking systems of South Korea,’’
systems,’’ Int. J. Data Netw. Sci., vol. 7, no. 3, pp. 1421–1434, Multimedia Tools Appl., vol. 74, no. 10, pp. 3289–3303, May 2015, doi:
2023. 10.1007/s11042-014-1888-3.

VOLUME 12, 2024 755

 N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

[90] I. Oh, K. Lee, S. Y. Lee, K. Do, H. B. Ahn, and K. Yim, ‘‘Vulnerability [109] D. Barik, J. Sanyal, and T. Samanta, ‘‘Denial-of-Service attack mitigation
analysis on the image-based authentication through the PS/2 interface,’’ in multi-hop 5G D2D wireless communication networks employing
in Proc. Int. Conf. Innov. Mobile Internet Services Ubiquitous Comput. double auction game,’’ J. Netw. Syst. Manag., vol. 31, no. 1, pp. 1–30,
(Advances in Intelligent Systems and Computing), vol. 773, 2019, Jan. 2023, doi: 10.1007/s10922-022-09695-z.
pp. 212–219, doi: 10.1007/978-3-319-93554-6_19. [110] P. Revathy and G. B. Jebamalar, A Review Based on Secure Banking
[91] A. Rawat, A. K. Singh, J. Jithin, N. Jeyanthi, and R. Thandeeswaran, Application Against Server Attacks, vol. 38. IOS Press, 2021.
‘‘RSJ approach for user authentication,’’ in Proc. Int. Conf. Adv. [111] K. B. Jalbani, M. Yousaf, M. S. Sarfraz, R. J. Oskouei, A. Hussain, and
Inf. Commun. Technol. Comput., vol. 12, 2016, pp. 1–6, doi: Z. Memon, ‘‘Poor coding leads to DoS attack and security issues in web
10.1145/2979779.2979880. applications for sensors,’’ Secur. Commun. Netw., vol. 2021, pp. 1–11,
[92] J. Banerjee, D. Majumdar, M. S. Pal, and D. Majumdar, May 2021.
‘‘Readability, subjective preference and mental workload studies [112] A. Kaur and K. Mustafa, ‘‘Preference-oriented password-based authenti-
on Young Indian adults for selection of optimum font type and cation,’’ in Information and Communication Technology for Competitive
size during onscreen reading,’’ Al Ameen J. Med. Sci., vol. 4, Strategies (Lecture Notes in Networks and Systems), vol. 191. Singapore:
pp. 131–143, Jan. 2011. [Online]. Available: http://ezproxy.lib.utexas. Springer, 2022, pp. 953–965.
edu/login?url=http://search.ebscohost.com/login.aspx?direct=true& [113] L. Li, Z. Xia, J. Wu, L. Yang, and H. Han, ‘‘Face presentation
db=a9h&AN=59806916&site=ehost-live attack detection based on optical flow and texture analysis,’’ J.
[93] M. A. H. Sijan, A. Shahoriar, M. Salimullah, A. S. Islam, and R. H. Khan, King Saud Univ.-Comput. Inf. Sci., vol. 34, no. 4, pp. 1455–1467,
‘‘A review on E-banking security in Bangladesh: An empirical study,’’ in Apr. 2022.
Proc. 2nd Int. Conf. Comput. Advancements, Mar. 2022, pp. 330–336, [114] R. H. Khan and J. Miah, ‘‘Performance evaluation of a new one-time
doi: 10.1145/3542954.3543002. password (OTP) scheme using stochastic Petri net (SPN),’’ in Proc. IEEE
[94] M. Botacin, H. Aghakhani, S. Ortolani, C. Kruegel, G. Vigna, D. Oliveira, World AI IoT Congr. (AIIoT), Jun. 2022, pp. 407–412.
P. L. D. Geus, and A. Grégio, ‘‘One size does not fit all,’’ ACM [115] H. Kanaker, N. A. Karim, S. A. B. Awwad, N. H. A. Ismail, J. Zraqou,
Trans. Privacy Secur. (TOPS), vol. 24, pp. 1–31, Jan. 2021, doi: and A. M. F. Al Ali, ‘‘Trojan horse infection detection in cloud based
10.1145/3429741. environment using machine learning,’’ Int. J. Interact. Mobile Technol.
[95] Z. T. Mamadiyarov, ‘‘Risk management in the remote provision of (iJIM), vol. 16, no. 24, pp. 81–106, Dec. 2022.
banking services in the conditions of digital transformation of banks,’’ in [116] S. Banerjee, M. P. Dutta, and C. T. Bhunia, ‘‘A perfect dynamic-id and
Proc. 5th Int. Conf. Future Netw. Distrib. Syst., Dec. 2021, pp. 311–317, biometric based remote user authentication scheme under multi-server
doi: 10.1145/3508072.3508119. environments using smart cards,’’ in Proc. 8th Int. Conf. Secur. Inf. Netw.,
[96] K. Kaushik, V. Singh, and V. P. Manikandan, ‘‘A novel approach for an Sep. 2015, pp. 58–64, doi: 10.1145/2799979.2799984.
automated advanced MITM attack on IoT networks,’’ in Proc. Int. Conf. [117] FFIEC Home Page. Accessed: May 1, 2023. [Online]. Available:
Advancements Interdiscipl. Res., vol. 1738, 2022, pp. 60–71. https://www.ffiec.gov/
[97] S. Yu and Y. Park, ‘‘ITSSAKA-MS: An improved three-factor symmetric- [118] Online Banking Security Features FAQS—Bank of America
key based secure AKA scheme for multi-server environments,’’ IEEE Security Center. Accessed: May 15, 2023. [Online]. Available:
Access, vol. 8, pp. 193375–193379, 2020. https://www.bankofamerica.com/security-center/faq/additional-security-
[98] F. S. D. Lima Filho, F. A. F. Silveira, A. de M. B. Junior, G. Vargas-Solar, features/
and L. F. Silveira, ‘‘Smart detection: An online approach for DoS/DDoS [119] Security Mechanism(Corporate Service). Accessed: Aug. 19, 2023.
attack detection using machine learning,’’ Secur. Commun. Netw., [Online]. Available: https://www.bankofchina.com/en/custserv/bocnet/
vol. 2019, pp. 1–15, Oct. 2019. 200812/t20081212_144526.html
[99] R. Singh and A. Soumya, ‘‘Updated comparative analysis on video [120] How to Stay a Step Ahead of Fraudsters | JP Morgan Private Bank.
conferencing platforms-zoom, Google meet, Microsoft Teams, WebEx Accessed: Aug. 19, 2023. [Online]. Available: https://privatebank.
Teams and GoToMeetings,’’ EasyChair, World Scientists, vol. 4026, jpmorgan.com/gl/en/about-us/cybersecurity-and-fraud-prevention-hub/
pp. 1–9, Aug. 2020. how-to-stay-a-step-ahead-of-fraudsters
[100] P. Shrestha and N. Saxena, ‘‘Hacksaw: Biometric-free non-stop web [121] Security Statement. Accessed: Aug. 19, 2023. [Online]. Available:
authentication in an emerging world of wearables,’’ in Proc. 13th ACM https://www.arabbank.jo/footernavigation/security-statement
Conf. Secur. Privacy Wireless Mobile Netw., 2020, pp. 13–24. [122] Branchless Banking Cimb Niaga. Accessed: Aug. 21, 2023. [Online].
[101] M. Ohm, H. Plate, A. Sykosch, and M. Meier, ‘‘Backstabber’s knife Available: https://branchlessbanking.cimbniaga.co.id/en/gomobiletnc-2/
collection: A review of open source software supply chain attacks,’’ [123] D. Dasgupta, Z. Akhtar, and S. Sen, ‘‘Machine learning in cybersecurity:
in Detection of Intrusions and Malware, and Vulnerability Assessment A comprehensive survey,’’ J. Defense Model. Simul., Appl., Methodol.,
(Lecture Notes in Computer Science), vol. 12223. Heidelberg, Germany: Technol., vol. 19, no. 1, pp. 57–106, Jan. 2022.
Springer, 2020, pp. 23–43, doi: 10.1007/978-3-030-52683-2_2. [124] D. Sadhukhan, S. Ray, G. P. Biswas, M. K. Khan, and M. Dasgupta, ‘‘A
[102] O. Jullian, B. Otero, E. Rodriguez, N. Gutierrez, H. Antona, and R. Canal, lightweight remote user authentication scheme for IoT communication
‘‘Deep-learning based detection for cyber-attacks in IoT networks: using elliptic curve cryptography,’’ J. Supercomput., vol. 77, no. 2,
A distributed attack detection framework,’’ J. Netw. Syst. Manag., vol. 31, pp. 1114–1151, Feb. 2021.
no. 2, p. 33, Apr. 2023. [125] S. Jagadeesh, S. M. Ali, S. P. G. Selvan, M. Aljanabi, M. Gopianand, and
[103] M. Alazab, ‘‘A discrete time-varying greywolf IoT botnet detection J. P. J. Hephzipah, ‘‘Hybrid AES-modified ECC algorithm for improved
system,’’ Comput. Commun., vol. 192, pp. 405–416, Aug. 2022. data security over cloud storage,’’ J. Adv. Res. Appl. Sci. Eng. Technol.,
[104] M. Alazab, R. A. Khurma, A. Awajan, and D. Camacho, ‘‘A new intrusion vol. 32, no. 1, pp. 46–56, Aug. 2023.
detection system based on moth-flame optimizer algorithm,’’ Exp. Syst. [126] J. L. Hevia, G. Peterssen, C. Ebert, and M. Piattini, ‘‘Quantum
Appl., vol. 210, Dec. 2022, Art. no. 118439. computing,’’ IEEE Softw., vol. 38, no. 5, pp. 7–15, Sep. 2021.
[105] M. Hijjawi, M. Alshinwan, O. A. Khashan, W. Alomoush, N. A. Karim, [127] A. Sharma and S. K. Lenka, ‘‘E91 QKD protocol for authentication
A. Y. Shdefat, S. S. Alqahtany, and E. Shudayfat, ‘‘A novel hybrid Prairie in online banking systems,’’ Int. J. Bus. Inf. Syst., vol. 22, no. 1,
dog algorithm and Harris hawks algorithm for resource allocation of pp. 116–122, 2016.
wireless networks,’’ IEEE Access, early access. [128] R. A. Grimes, Hacking Multifactor Authentication. Hoboken, NJ, USA:
[106] H. Chen, F. Li, W. Du, S. Yang, M. Conn, and Y. Wang, ‘‘Listen to Wiley, 2020.
your fingers: User authentication based on geometry biometrics of touch [129] D.-T. Dam, T.-H. Tran, V.-P. Hoang, C.-K. Pham, and T.-T. Hoang,
gesture,’’ Proc. ACM Interact., Mobile, Wearable Ubiquitous Technol., ‘‘A survey of post-quantum cryptography: Start of a new race,’’
vol. 4, pp. 1–23, Sep. 2020, doi: 10.1145/3411809. Cryptography, vol. 7, no. 3, p. 40, Aug. 2023.
[107] S. Manoharan, N. Katuk, S. Hassan, and R. Ahmad, ‘‘To click or not to [130] S. Biswas, B. Carson, V. Chung, S. Singh, and R. Thomas, AI-Bank of
click the link: The factors influencing internet banking users’ intention in the Future: Can Banks Meet the AI Challenge. New York, NY, USA:
responding to phishing emails,’’ Inf. Comput. Secur., vol. 30, pp. 37–62, McKinsey, 2020.
Jan. 2022. [131] H. U. Khan, M. Z. Malik, S. Nazir, and F. Khan, ‘‘Utilizing
[108] M. Shurman, R. Khrais, and A. Yateem, ‘‘DoS and DDoS attack detection bio metric system for enhancing cyber security in banking sector:
using deep learning and IDS,’’ Int. Arab J. Inf. Technol., vol. 17, no. 4, A systematic analysis,’’ IEEE Access, vol. 11, pp. 80181–80198,
pp. 655–661, Jul. 2020. 2023.

756 VOLUME 12, 2024

N. A. Karim et al.: Online Banking User Authentication Methods: A Systematic Literature Review

[132] K. Morovat and B. Panda, ‘‘A survey of artificial intelligence in OSAMA AHMED KHASHAN received the M.Sc.
cybersecurity,’’ in Proc. Int. Conf. Comput. Sci. Comput. Intell. (CSCI), degree in information technology from Universiti
Dec. 2020, pp. 109–115. Utara Malaysia, Malaysia, in 2008, and the Ph.D.
[133] K. Shaukat, S. Luo, V. Varadharajan, I. A. Hameed, and M. Xu, ‘‘A survey degree in computer science from the National
on machine learning techniques for cyber security in the last decade,’’ University of Malaysia, Malaysia, in 2014.
IEEE Access, vol. 8, pp. 222310–222354, 2020. He is currently an Associate Professor/Associate
[134] C.-Z. Yang, J. Ma, S. Wang, and A. W. Liew, ‘‘Preventing DeepFake Researcher with the Research and Innovation
attacks on speaker authentication by dynamic lip movement analysis,’’
Centers, Rabdan Academy, Abu Dhabi, United
IEEE Trans. Inf. Forensics Security, vol. 16, pp. 1841–1854, 2021.
Arab Emirates. His research interests include
[135] P. Chhajed and D. Phalke, ‘‘A review on deepfake attack detection of
user,’’ Tech. Rep. information security, cyber security, cryptography,
[136] A. Alomari, N. Idris, A. Q. M. Sabri, and I. Alsmadi, ‘‘Deep blockchain technology, the Internet of Things, and image processing.
reinforcement and transfer learning for abstractive text summarization:
A review,’’ Comput. Speech Lang., vol. 71, Jan. 2022, Art. no. 101276.
[137] Y. Sun and L. Gu, ‘‘Attention-based machine learning model for smart
contract vulnerability detection,’’ J. Phys., Conf., vol. 1820, no. 1, HASAN KANAKER received the Ph.D. degree
Mar. 2021, Art. no. 012004. from Islamic Science University of Malaysia
[138] K. Filus and J. Domanska, ‘‘Software vulnerabilities in TensorFlow- (USIM), in 2018. He is currently the Head of the
based deep learning applications,’’ Comput. Secur., vol. 124, Jan. 2023, Department of Computer Information System and
Art. no. 102948.
the Department of Cybersecurity, Isra University,
[139] F. Musumeci, A. C. Fidanci, F. Paolucci, F. Cugini, and M. Tornatore,
Jordan. He has a very strong experience in the
‘‘Machine-learning-enabled DDoS attacks detection in p4 programmable
networks,’’ J. Netw. Syst. Manag., vol. 30, no. 1, pp. 1–27, Jan. 2022. areas of networking, malware detection, cyber
[140] A. C. Bahnsen, I. Torroledo, L. D. Camacho, and S. Villegas, ‘‘Deepphish: security, and online education. In addition, he had
Simulating malicious ai,’’ in Proc. APWG Symp. Electron. Crime Res. been working on a number of research projects,
(eCrime), 2018, pp. 1–8. including one detection of malware in the cloud
[141] A. Basit, M. Zafar, X. Liu, A. R. Javed, Z. Jalil, and K. Kifayat, computing environment, user authentication for online exams, and utilizing
‘‘A comprehensive survey of AI-enabled phishing attacks detection neural networks to analyze medical images. His research interests include
techniques,’’ Telecommun. Syst., vol. 76, no. 1, pp. 139–154, Jan. 2021. network security, intrusion detection, data mining, malware detection,
[142] M. Hijjawi, M. Alshinwan, O. A. Khashan, M. Alshdaifat, machine learning, cloud computing security, and information security.
W. Almanaseer, W. Alomoush, H. Garg, and L. Abualigah, ‘‘Accelerated
arithmetic optimization algorithm by cuckoo search for solving
engineering design problems,’’ Processes, vol. 11, no. 5, p. 1380,
May 2023.
[143] L. Abualigah, D. Oliva, H. Jia, F. Gul, N. Khodadadi, A. G. Hussien,
WALEED K. ABDULRAHEEM received the B.S.
M. A. Shinwan, A. E. Ezugwu, B. Abuhaija, and R. A. Zitar, ‘‘Improved degree in computer and networks from Arab Open
Prairie dog optimization algorithm by dwarf mongoose optimization University, Jordan, in 2012, the M.S. degree in
algorithm for optimization problems,’’ Multimedia Tools Appl., pp. 1–41, computer and information security from Middle
Sep. 2023. East University, Jordan, in 2014, and the Ph.D.
[144] Z. Rui and Z. Yan, ‘‘A survey on biometric authentication: Toward degree in cybersecurity from Universiti Putra
secure and privacy-preserving identification,’’ IEEE Access, vol. 7, Malaysia, Malaysia, in 2019. He is currently
pp. 5994–6009, 2019. an Assistant Professor with The World Islamic
[145] Y. Chandrasekran, C. R. Ramachandiran, and K. C. Arun, ‘‘Adoption of Sciences and Education University. His research
future banking using biometric technology in automated teller machine interests include cryptography, the IoT security,
(ATM),’’ in Proc. IEEE Int. Conf. Distrib. Comput. Electr. Circuits and cloud security.
Electron. (ICDCECE), Apr. 2022, pp. 1–4.
[146] P. M. C. Arta, D. Bagus, A. Dodik, and S. H. Bambang, ‘‘Factor analysis
of the net benefits of accounting information systems with system use
and user satisfaction as mediating variables,’’ Eurasia, Econ. Bus., vol. 1,
no. 43, pp. 34–48, 2021. MOHAMMAD ALSHINWAN received the Ph.D.
[147] Y. Oren and D. Arad, ‘‘Toward usable and accessible two-factor degree from the School of Computer Engineering,
authentication based on the piezo-gyro channel,’’ IEEE Access, vol. 10, Inje University, Gimhae, Republic of Korea,
pp. 19551–19557, 2022. in 2017. He was an Assistant Professor with
the Department of Computer and Information
Sciences, Amman Arab University, Jordan. He is
NADER ABDEL KARIM received the Ph.D. currently an Associate Professor with Applied
degree in cybersecurity from UKM, in 2017. Science Private University, Jordan. His research
He is currently a Faculty Member with the interests include computer networks, mobile net-
Department of Cybersecurity, College of Artificial works, information security, AI, and optimization
Intelligence, Al-Balqa Applied University. He is methods.
also a Distinguished Cybersecurity Expert. His
contributions to the field extend beyond academia,
as he actively shares knowledge through prolific
writing for specialized websites, such as CyberX. ABEDAL-KAREEM AL-BANNA is currently pur-
His articles cover a wide range of cybersecurity suing the Ph.D. degree with Loughborough Uni-
topics, from in-depth analyses of emerging threats to practical guides versity, U.K. He is the CTO and the Co-Founder of
for implementing robust security measures. Notably, the work on user Jordanian Startup called TAKALAM, a company
authentication methods has garnered attention for striking a balance between that provides solutions for hearing and speech
security and user convenience. He has a very strong experience in the disorders. He is a member of the Leaders in
areas of user authentication, cyber security, human–computer interaction Innovation Fellowship at the Royal Academy of
(HCI), and online learning. He has also participated in a number of research Engineering, U.K., in 2020.
projects, including ones on virtual privacy techniques and preferences-based
authentication.

VOLUME 12, 2024 757