It seems like three-factor is a mistake in the article, but what you suggest is very close to the three factors that will be involved in SCA (Strong Customer Au

It seems like three-factor is a mistake in the article, but what you suggest is very close to the three factors that will be involved in SCA (Strong Customer Authentication), an upcoming European regulatory requirement to reduce fraud in payments: https://stripe.com/guides/strong-customer-authentication#what-is-strong-customer-authentication https://stripe.com/guides/strong-customer-authentication#wha... (Although only two of the three will be required.)