The Effectiveness of Two-Factor Authentication in Preventing Online Banking Fraud in Nigeria

Abstract

This research evaluates the effectiveness of two-factor authentication (2FA) in the context of fraud in online banking in Nigeria. A mixed-method approach combining statistical data from 2019 to 2024, banking security experts' opinions and a challenge-response authentication system prototype evaluation is utilised to understand the effectiveness of the existing 2FA security mechanisms against online banking fraud in Nigeria. The findings show that fraud cases decreased by about 10-15% after the proliferation of 2FA while there was a reduction in the compromise rate to 0% for app-based authentication compared to 4% for SMS-OTP. The findings suggest that despite reducing the rate of low-level fraud by approximately 10-15%, 2FA has a minimal impact on financial losses, which is escalating because of sophisticated attacks such as phishing and SIM-swap fraud. Qualitative findings emphasise the numerous loopholes in SMS-based 2FA, such as latency, vulnerability to interception and dependency on unsafe fallback mechanisms; biometric and app-based authentication methods appear more practical, faster and secure and have been confirmed by the prototype evaluation with a drastic reduction in the compromise rate and improvement in user experience in app-based 2FA, especially against complex attack scenarios. Hence, it recommends the use of a combination of security measures such as advanced authentication systems, real-time fraud detection mechanisms (using artificial intelligence), and user education awareness programmes, as 2FA alone is not sufficient to defend against the increasing threats, thus it would be of interest to banking institutions and regulators hoping to improve security frameworks within developing digital economies.