If the "something you have" part of 2FA can be replicated then it's not 2FA. So you need a "something you know" (password, PIN, etc.) and a "something you have"

If the "something you have" part of 2FA can be replicated then it's not 2FA. So you need a "something you know" (password, PIN, etc.) and a "something you have" (a phone app authorization, a card that cannot be replicated, etc.). This excludes anything with a magnetic strip from being any part of the 2FA scheme.