Mobile payment (M-payment) security is essential in the digital era due to the risks of malware and other threats that affect user privacy and financial security. This paper reviews advancements in M-payment security while addressing ongoing challenges. We investigate current approaches, including secure online and offline systems, focusing on multi-layered phone-side security measures like information protection, logging, and malware detection, as well as server-side user authentication with blacklists and dynamic instructions. These strategies uphold core security principles such as confidentiality, integrity, and non-repudiation while preventing fraud like double spending and money laundering. Nevertheless, challenges remain, including balancing security and computational efficiency, protecting user privacy, and ensuring usability. M-payment systems face various vulnerabilities, including phone/device, location-time, and login attacks.