Seems to me that when you turn it into data, it pretty much all becomes "something you know." If a credit card required biometric authentication to make credit

Seems to me that when you turn it into data, it pretty much all becomes "something you know." If a credit card required biometric authentication to make credit card transactions and a vendor stored my biometric signature in a database along with my credit card number, it would be no more or less secure than a 3 digit number. There are better ways to handle it. Policy is a good interim step to mitigate damage before they're implemented.