ADAPTIVE RISK-BASED MULTI-LAYER AUTHENTICATION FRAMEWORK FOR SECURE ONLINE BANKING SYSTEMS

Abstract

Digital banking services have grown rapidly, increasing exposure to credential theft, phishing, replay attacks, and account takeover fraud. Traditional, single-factor, and static multi-factor authentication systems are still susceptible in the event that attackers breach one or more levels of authentication. This paper presents and experimentally confirms an adaptive risk-based multi-layer authentication system adapted to an online banking context. The model integrates knowledge-based verification (PIN), recognition-based graphical authentication, possession-based one-time password (OTP), and a dynamic risk-scoring engine that adjusts authentication strictness based on contextual indicators such as login location, device profile, and behavioral anomalies. A probabilistic security model is designed to measure the likelihood of attack success, measured by independent authentication layers. The framework was tested in the web-based prototype environment and tested with 120 participants who underwent 500 total authentication attempts, and with simulated adversarial conditions. False Acceptance Rate (FAR), False Rejection Rate (FRR), Equal Error rate (EER), Area Under the ROC Curve (AUC), Precision, recall, and response time were used to measure the performance. The presented adaptive framework demonstrated a high authentication rate of 98.9, FAR of 0.7, FRR of 2.6, and EER of 1.65, which is considerably higher than single-factor and fixed two-factor baselines. The ROC analysis had an AUC equal to 0.991, which implies that it has a high discrimination ability. These results indicate that risk-adaptive authentication has a higher resilience to fraud and can still be operated effectively.