Rapid development of wireless networks brings about many security problems in mobile communications. In this regard, designing a secure user authentication scheme, especially for recognizing legal roaming users is indeed a challenging task. Recently, Wen et al. proposed such scheme, which is claimed to be a slight modification of Qi et al.'s protocol based on smart card. However, we reveal that both the schemes still suffer from certain weaknesses and thus they cannot achieve desired security. Therefore, here we propose an improved protocol of Wen et al. which can immune to various known types of attacks like forgery attack, replay attack, known session key attack, backward and forward secrecy etc.