Authentication factor

The three-category taxonomy - knowledge, possession, inherence - is codified in several places with slightly different consequences. NIST SP 800-63B (revision 4, finalised in 2025) does not treat factors as abstract categories but as authenticator types: memorised secrets (passwords), look-up secrets, out-of-band devices, single- and multi-factor OTP devices, single- and multi-factor cryptographic authenticators (software or hardware). A multi-factor cryptographic device such as a smart card unlocked by a PIN, or a FIDO2 authenticator with user verification, delivers two factors in one object. In EU payments law, the PSD2 strong customer authentication rules (Commission Delegated Regulation (EU) 2018/389) define the elements in Articles 6 (knowledge), 7 (possession) and 8 (inherence), and Article 9 adds an explicit independence requirement: the breach of one element must not compromise the reliability of the others.

Independence is the property most often lost in practice. A password manager and an authenticator app on the same unlocked phone, or an SMS code delivered to the device on which the user is logging in, collapse two nominal factors into one attack surface. Similarly, "knowledge-based" questions (mother's maiden name) are frequently public knowledge and add little entropy.

Biometrics are special. A biometric trait is not a secret - faces are photographed and fingerprints are left on glass - so its security rests on presentation attack detection (liveness) and on the matcher's false-match rate. NIST therefore only accepts biometrics as part of multi-factor authentication bound to a specific physical authenticator, never as a standalone factor, and in mainstream platforms the biometric is verified locally only to unlock a private key held in a secure element or TPM; the template never leaves the device. A compromised biometric cannot be rotated, which is another reason it is used as a local gate rather than as a transmitted credential.

Contextual signals - IP address, geolocation, device posture, behavioural patterns - are sometimes called "somewhere you are" or a fourth factor. Standards bodies generally do not count them as authentication factors; they feed risk-based or conditional access decisions that can demand step-up authentication. The strength of an authentication event depends less on the number of factors than on their resistance to phishing, replay and interception: a password plus a phishable OTP is two factors, while a device-bound passkey with user verification is also two factors but defeats relay attacks through origin binding.