Authentication Models and Verification Factors
Something you know, have or are, depending on the case
Authentication models are built around three types of verification factors: something the user knows, such as a password or PIN; something they have, such as a physical token or the phone where they receive a code; and something they are, referring to biometric characteristics such as a fingerprint or facial recognition. Combining two or more of these factors is what gives an authentication system real strength. Understanding this classification matters in practice because it makes it possible to design controls proportional to risk, using a single factor for low-impact actions and requiring stronger combinations for sensitive operations such as bank transfers or access to administrative systems. A relevant nuance is that not all factors are equally resistant to attacks; for example, a code sent by SMS can be intercepted through SIM swapping techniques, while a physical security key or a cryptographic token resists that type of attack much more effectively.