{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T22:11:57Z","timestamp":1789078317110,"version":"build-2803163510"},"reference-count":66,"publisher":"International Journal of Global Information Systems (GLOBEIS)","issue":"1","license":[{"start":{"date-parts":[[2026,8,24]],"date-time":"2026-08-24T00:00:00Z","timestamp":1787529600000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["GlobeISJ"],"abstract":"<jats:p>The escalation of cyber-attacks has intensified the need for stronger multi-factor authentication (MFA), motivating a shift from traditional knowledge- and possession-based factors, such as SMS one-time passwords (OTP) and time-based one-time passwords (TOTP), toward FIDO2\/WebAuthn credentials and passkeys. This study qualitatively compares five widely deployed MFA methods, grouped as traditional (SMS-based OTP, TOTP, and push-based authentication) and advanced (FIDO2 security keys and platform biometric authenticators), across four criteria: usability, security, cost, and implementation challenges. Adopting an interpretive qualitative design, the study draws on semi-structured interviews with four identity-and-access-management (IAM) practitioners, analysed through Braun and Clarke's six-phase reflexive thematic analysis. Coding produced an initial framework of 30 codes that was consolidated into four themes corresponding to the study criteria. Practitioners consistently characterised traditional methods as more affordable and broadly familiar but weaker in security and more prone to operational reliability problems, whereas FIDO2 security keys and platform biometrics were described as offering stronger phishing resistance and smoother day-to-day operation at a higher initial and maintenance cost. The study situates these accounts within organisational governance and cross-regional regulatory drivers of adoption and recommends a risk-based migration toward FIDO2\/WebAuthn and passkeys.<\/jats:p>","DOI":"10.66395\/globeis.19","type":"journal-article","created":{"date-parts":[[2026,8,24]],"date-time":"2026-08-24T16:59:53Z","timestamp":1787590793000},"page":"119-133","source":"Crossref","is-referenced-by-count":0,"title":["Comparing Multi-Factor Authentication Methods from SMS and TOTP to FIDO2\/WebAuthn and Passkeys: A Qualitative Study of Practitioner Perspectives"],"prefix":"10.66395","volume":"2","author":[{"given":"Femi","family":"Folorunsho","sequence":"first","affiliation":[{"id":[{"id":"https:\/\/ror.org\/00k6tx165","id-type":"ROR","asserted-by":"publisher"}],"name":"Ball State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zubair","family":"Odeleye","sequence":"additional","affiliation":[{"name":"Wale University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"56016","published-online":{"date-parts":[[2026,8,24]]},"reference":[{"key":"593","unstructured":"1. Abbas, W., Joshua, S. R., Abbas, A., & Lee, J. H. (2025). An end-to-end GSM\/SMS encrypted approach for smartphone employing advanced encryption standard (AES). arXiv. https:\/\/arxiv.org\/abs\/2503.18859"},{"key":"594","doi-asserted-by":"publisher","DOI":"10.37275\/nasetjournal.v5i1.62"},{"key":"595","doi-asserted-by":"publisher","DOI":"10.9734\/ajrcos\/2020\/v5i330135"},{"key":"596","doi-asserted-by":"publisher","DOI":"10.1177\/1541931218621262"},{"key":"597","doi-asserted-by":"publisher","DOI":"10.1109\/ICECSP61809.2024.10698540"},{"key":"598","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-48855-9_16"},{"key":"599","doi-asserted-by":"publisher","DOI":"10.1145\/3734864"},{"key":"600","doi-asserted-by":"publisher","DOI":"10.1145\/3654661"},{"key":"601","doi-asserted-by":"publisher","DOI":"10.21567\/adhyayan.v13i2.10"},{"key":"602","doi-asserted-by":"publisher","DOI":"10.1080\/19393555.2021.1873464"},{"key":"603","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3445931"},{"key":"604","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-99-5177-2_7"},{"key":"605","unstructured":"13. Bicakci, K., Varli, F. M., Korkmaz, M. E., & Uzunay, Y. (2026). QES-backed virtual FIDO2 authenticators: Architectural options for secure, synchronizable WebAuthn credentials. arXiv. https:\/\/arxiv.org\/abs\/2601.06554"},{"key":"606","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179454"},{"key":"607","unstructured":"15. Burda, K. (2025). Electronic identification of persons and objects \u2013 current status. International Journal of Computer Science and Network Security, 25(6), 1."},{"key":"608","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2025.104823"},{"key":"609","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3436812"},{"key":"610","doi-asserted-by":"publisher","DOI":"10.1109\/eIT64391.2025.11103704"},{"key":"#cr-split#-611.1","unstructured":"19. European Parliament & Council of the European Union. (2014). Regulation"},{"key":"#cr-split#-611.2","unstructured":"(EU) No 910\/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999\/93\/EC (eIDAS). Official Journal of the European Union, L 257, 73-114. http:\/\/data.europa.eu\/eli\/reg\/2014\/910\/oj"},{"key":"#cr-split#-612.1","unstructured":"20. European Parliament & Council of the European Union. (2015). Directive"},{"key":"#cr-split#-612.2","unstructured":"(EU) 2015\/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market (PSD2). Official Journal of the European Union, L 337, 35-127. http:\/\/data.europa.eu\/eli\/dir\/2015\/2366\/oj"},{"key":"613","doi-asserted-by":"publisher","DOI":"10.1145\/3778360"},{"key":"614","unstructured":"22. Ganmati, A., Afdel, K., & Koutti, L. (2025). Deep learning-based multi-factor authentication: A survey of biometric and smart card integration approaches. arXiv. https:\/\/arxiv.org\/abs\/2510.05163"},{"key":"615","unstructured":"23. George, A. S. (2024). The dawn of passkeys: Evaluating a passwordless future. Partners Universal Innovative Research Publication, 2(1), 202\u2013220."},{"key":"616","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-63b"},{"key":"617","doi-asserted-by":"publisher","DOI":"10.1002\/9781394242177.ch7"},{"key":"618","doi-asserted-by":"publisher","DOI":"10.1109\/AICT50176.2020.9368574"},{"key":"619","unstructured":"27. Idrus, Z. S. S., Cherrier, E., Rosenberger, C., & Schwartzmann, J. J. (2013). A review on authentication methods. Australian Journal of Basic and Applied Sciences, 7(5), 95\u2013107."},{"key":"620","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-96-0576-7_14"},{"key":"621","doi-asserted-by":"publisher","DOI":"10.1145\/3711117"},{"key":"622","doi-asserted-by":"publisher","DOI":"10.1145\/3700838.3700868"},{"key":"623","unstructured":"31. Kamaruddin, N. H. C., & Zolkipli, M. F. (2024). The role of multi-factor authentication in mitigating cyber threats. Borneo International Journal, 7(4), 35\u201342."},{"key":"624","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3346045"},{"key":"625","doi-asserted-by":"publisher","DOI":"10.1007\/s11227-025-08029-5"},{"key":"626","doi-asserted-by":"publisher","DOI":"10.1080\/19361610.2025.2508726"},{"key":"627","doi-asserted-by":"publisher","DOI":"10.1109\/ICMSCI62561.2025.10894609"},{"key":"628","doi-asserted-by":"publisher","DOI":"10.3390\/app10082961"},{"key":"629","unstructured":"37. Lassak, L., Pan, E., Ur, B., & Golla, M. (2024). Why aren't we using passkeys? Obstacles companies face deploying FIDO2 passwordless authentication. In 33rd USENIX Security Symposium (pp. 7231\u20137248)."},{"key":"630","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00047"},{"key":"631","doi-asserted-by":"publisher","DOI":"10.1177\/2633559X241280392"},{"key":"632","doi-asserted-by":"publisher","DOI":"10.3390\/app15084414"},{"key":"633","unstructured":"41. Mitra, A., & Sethuraman, S. C. (2025). Verifiable passkey: The decentralized authentication standard. arXiv. https:\/\/arxiv.org\/abs\/2512.21663"},{"key":"634","doi-asserted-by":"publisher","DOI":"10.47772\/IJRISS.2025.90300240"},{"key":"635","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73128-0_40"},{"key":"636","doi-asserted-by":"publisher","DOI":"10.21275\/SR21403140109"},{"key":"637","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.5146650"},{"key":"638","doi-asserted-by":"publisher","DOI":"10.3390\/cryptography2010001"},{"key":"639","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2019.1800240"},{"key":"640","doi-asserted-by":"publisher","DOI":"10.58496\/MJCSC\/2023\/016"},{"key":"641","doi-asserted-by":"publisher","DOI":"10.3390\/info14070386"},{"key":"642","unstructured":"50. PCI Security Standards Council. (2022). Payment Card Industry Data Security Standard: Requirements and testing procedures (Version 4.0). https:\/\/www.pcisecuritystandards.org"},{"key":"643","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3497756"},{"key":"644","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-65277-7_1"},{"key":"645","doi-asserted-by":"publisher","DOI":"10.1109\/ICECCC65144.2025.11064011"},{"key":"646","unstructured":"54. Qian, Y. (2024). Applying combined one-time passwords to prevent phishing attacks in electronic banking. Journal of Artificial Intelligence and Systems Modelling, 2(4), 32\u201346."},{"key":"647","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-97-4727-6_38"},{"key":"648","unstructured":"56. Reese, K., Smith, T., Dutson, J., Armknecht, J., Cameron, J., & Seamons, K. (2019). A usability study of five two-factor authentication methods. In Proceedings of the 15th Symposium on Usable Privacy and Security (SOUPS) (pp. 357\u2013370)."},{"key":"649","doi-asserted-by":"publisher","DOI":"10.33480\/jitk.v10i2.5970"},{"key":"650","doi-asserted-by":"publisher","DOI":"10.1080\/19393555.2025.2536033"},{"key":"651","doi-asserted-by":"publisher","DOI":"10.1109\/Confluence60223.2024.10463322"},{"key":"652","doi-asserted-by":"publisher","DOI":"10.1177\/20552076231177144"},{"key":"653","doi-asserted-by":"publisher","DOI":"10.7717\/peerj-cs.678"},{"key":"654","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2025.3528960"},{"key":"655","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2025.3550883"},{"key":"656","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2025.3593598"}],"container-title":["International Journal of Global Information Systems"],"original-title":[],"link":[{"URL":"https:\/\/globeisjournal.com\/index.php\/globeis\/article\/download\/19\/11","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/globeisjournal.com\/index.php\/globeis\/article\/download\/19\/11","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T21:29:06Z","timestamp":1789075746000},"score":1,"resource":{"primary":{"URL":"https:\/\/globeisjournal.com\/index.php\/globeis\/article\/view\/19"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,24]]},"references-count":66,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,6,1]]}},"URL":"https:\/\/doi.org\/10.66395\/globeis.19","relation":{},"ISSN":["3108-7213"],"issn-type":[{"value":"3108-7213","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,24]]}}}