It's usually considered something you know, since it's used as password replacement (first factor). You can create schemes where it could be considered a second

It's usually considered something you know, since it's used as password replacement (first factor). You can create schemes where it could be considered a second factor (used together with a password, mandatory smartcard/fob storage, etc.), but that's not the regular case. At the same time, it's easy to turn password+TOTP into a single factor by storing both in the same password manager… the theoretical MFA definitions are not the most practical.