MULTI-FACTOR AUTHENTICATION FOR RFID STADIUM ACCESS CONTROL: INTEGRATING BIOMETRIC VERIFICATION TO PREVENT TICKET-PASSING FRAUD

Abstract

Radio Frequency Identification (RFID) turnstile systems have become a common ingress-control mechanism for large-capacity football stadiums, offering fast, contactless verification of ticket tokens. However, token-only verification cannot distinguish between the rightful ticket holder and a third party who possesses the same wristband or a cloned tag, leaving such systems structurally exposed to ticket-passing and proxy-attendance fraud. This paper proposes and evaluates a multi-factor authentication (MFA) architecture that augments an existing RC522/ESP32-based RFID stadium access control system with a fingerprint biometric verification stage, combined through a decision-gated, weighted score-level fusion rule. A Monte Carlo simulation (100,000 genuine and 100,000 fraudulent trials) was used to characterise the trade-off between security and throughput. At the Equal Error Rate (EER) operating point, the proposed system achieves a False Acceptance Rate (FAR) of 1.205% against pass-back/proxy fraud, compared with a 100% FAR for the same attack under the RFID-only baseline, since a valid token is, by design, always accepted by a token-only reader. The added biometric step increases per-spectator gate service time from 1.2 s to between 1.45 s and 2.05 s depending on sensor choice, which is shown, through a Pollaczek-Khinchine queueing approximation, to remain operationally acceptable when lane count is increased modestly. The paper reports the complete simulation methodology, all governing equations, and an explicit discussion of the synthetic nature of the biometric score model, consistent with a system-level feasibility study rather than a hardware-validated deployment. Results indicate that decision-gated biometric fusion is a practical, low-cost mitigation for the proxy-attendance vulnerability identified in prior RFID-only stadium access control work.