I see two factor but not Out-Of-Band mentioned (didn't read the whole thing). • something the user knows (e.g., password, PIN); • something the user possesses (e.g., ATM card, smart card); and • something the user is (e.g., biometric characteristic, such as a fingerprint or retinal pattern).