I don't know the exact workings, but usually the authentication popup should popup with at least 1 other factor to challenge(e.g. touchid or password) if it has

I don't know the exact workings, but usually the authentication popup should popup with at least 1 other factor to challenge(e.g. touchid or password) if it hasn't asked recently. That way it uses 1) something you are (touchID) and something you have (Validation from a known good device) as the 2 factors.