A possession factor authenticates identity through something the user has, such as a badge, smartphone, or device running an authenticator app. section 11.3.2
Possession is one of three authentication-factor categories alongside knowledge and inherence. Multifactor authentication requires factors from different categories, not two knowledge factors such as a password and PIN. section 11.3.2 section 11.6
Common possession factors include:
- An ID badge presented to a badge reader. section 11.3.2
- A smartphone receiving SMS codes or push notifications. section 11.3.2
- An authenticator app generating one-time codes on a specific device. section 11.3.2
MFA login
A username and password provide a knowledge factor, while an SMS code delivered to the user’s smartphone provides a possession factor. section 11.3.2
