This survey presents a systematic evaluation of Multi-Factor Authentication (MFA) practices in digital payment systems, analyzing their alignment with NIST Special Publications 800-63 guidelines. Through a comprehensive review of 70 academic papers published between 2017–2024 and 13 industry-based authentication tools, we examine how current implementations measure against Identity Assurance Level (IAL) and Authentication Assurance Level (AAL) standards. Our analysis reveals a significant gap between theoretical capabilities proposed in academic research and actual industry implementations, with 33% of tools relying primarily on OTP-based authentication despite more advanced methods being available. The survey identifies emerging trends like biometric authentication adoption (60% of analyzed papers) and varying regulatory compliance across sectors, with payment systems demonstrating 77% alignment with standards while IoT and E-Service domains show fragmented approaches. We propose a framework for developing adaptive authentication systems that balance security requirements with user experience through context-aware risk assessment. This work provides valuable insights for researchers, practitioners, and policymakers working to enhance the security and usability of digital payment authentication systems.

Abstract Mobile apps represent essential tools in our daily routines, supporting us in almost every task. However, this assistance might imply a high cost in terms of privacy. Indeed, mobile apps gather a massive amount of data about individuals (e.g., users’ profiles and habits) and their devices (e.g., locations), where not all are strictly needed for app execution. According to privacy laws, apps’ providers must inform end-users on adopted data usage practices (e.g., which data are collected and for which purpose). Unfortunately, understanding these practices is a complex task for average end-users. The result is that they install apps without understanding their privacy implications. To support users in making more privacy-aware decisions on app usage, we propose a risk estimation approach based on an analysis of the app’s code. This analysis adopts a hybrid strategy, exploiting static and dynamic code analyses. Static analysis aims at discovering which personal data an app is collecting to determine whether the target app is asking more than required. This gives the first estimation of the app’s risk level. In addition, we also perform a dynamic analysis of the target app’s code. This further analysis helps determining whether the collected personal data is consumed locally on the mobile device or sent out to external services. If this happens, the risk level has to be increased, as personal data are more exposed. To prove the proposal’s effectiveness, we run several experiments involving different groups of participants. The obtained accuracy results are promising and outperform those obtained with static analysis only.

The cash on delivery (CoD) is currently one of the significant payment mechanism in many developing countries' E-commerce systems. A transaction between a seller and a purchaser is completed when the seller has agreed to exchange packaged goods for a payment from the purchaser. Building highly trustworthy, accountable, credible, and decentralized CoD systems to trace and track physical items is a very challenging task. Several technologies and models for deploying CoD-based applications have been proposed in the literature. In most scenarios, these models have been created with the aim of accommodating collaborative processes involving multiple participants, e.g. seller, purchasers, and shippers, that belong to independent organizations. However, these approaches face several limitations and require appropriate improvement to sustain CoD-based systems' adoption further. First of all, there are no incentives for participants to act honestly. Secondly, the shippers are often kept out of the delivery chain and are affected by or not involved in any incentives or logs. Last but not least, users' privacy can be easily compromised and sensitive data collected and generated during the transactions can be easily accessed and abused. Building upon these critical insights, we propose a novel decentralized marketplace mechanism using the smart contract via blockchain technology. Our approach operates by incentivizing all the participants to act honestly and fulfill their obligations without resorting to a trusted third party. It also integrates adapted access control protocols to protect user privacy. The model's architecture shows that our approach guarantees integrity and robustness. It contributes to effectively addressing the issues listed above. A complete code solution is publicized on the authors' GitHub repository to engage further reproducibility and improvement.