This paper presents a lightweight multi-factor mobile user authentication scheme. It combines the biometrics of users and information of smart phones to realize mutual authentication between users and remote servers. This algorithm uses a lightweight encryption algorithm to achieve quick authentication. Compared with the previous biological features, our scheme does not save the biological feature template. So there is no disclosure of the users biological characteristics. The solution also enables off-line updating of biometrics and passwords, reducing not only the traffic but also the security threats posed by open channels. This scheme can better resist the currently known attacks, and has superior performance.