Three-Factor Authentication Explained: The Identity Challenge Card

Three-factor authentication (3FA) is a sign-in that requires three factors before access is granted, where two-factor authentication (2FA) stops at two. Avatier's Identity Challenge Card™ is a three-factor check on one printed credential: the card, a PIN only the user knows and the user's directory identity, with all three factors required.

This post starts with the classic definitions, then maps them onto a real credential, so you can see what each factor is doing and what an attacker would need to beat it. For the broader single-factor versus multi-factor picture, see Single-Factor vs Multi-Factor Authentication.

What counts as an authentication factor

NIST's Digital Identity Guidelines, SP 800-63-4, put it plainly: "The three types of authentication factors are something you know, something you have, and something you are."

Factor type	NIST's example	How NIST says it can fail
Something you know	A password	It "may be disclosed to an attacker"
Something you have	A device containing a cryptographic key	It "may be lost, damaged, stolen from the owner, or cloned"
Something you are	A fingerprint or other biometric characteristic data	It "may be replicated, or a false match may occur"

The rule that matters most is independence. NIST states that "Multiple instances of the same factor still constitute single-factor authentication," and gives the example that "a user-generated PIN and a password do not constitute two factors as they are both 'something you know.'" Its definition of MFA reads: "An authentication system that requires more than one distinct type of authentication factor for successful authentication."

The authentication volume, SP 800-63B, adds that "one authentication factor cannot be leveraged to obtain an authenticator of a different factor." If a stolen password can be used to enroll a new phone, the second factor was never really separate.

3FA vs 2FA: what a third factor adds

2FA checks two distinct factors, for example a password plus a one-time code sent to, or generated on, a phone. 3FA asks for a third, so an attacker has to defeat one more independent check, of a different kind, at the same moment.

The value comes from how differently each factor fails, as the table shows. NIST also notes that "Out-of-band secrets may be intercepted by an attacker and used to authenticate their own session," and that "A subscriber may be socially engineered to provide access to secrets without intentional collusion." A design that spreads factors across different failure modes makes a single compromise less useful.

Factor count isn't the whole story, though. A third factor that lives on the same phone as the second adds less than it seems, because losing the phone loses both. For which methods resist phishing outright, see Phishing-Resistant MFA for Enterprise in 2026.

The Identity Challenge Card's three factors

Avatier's Identity Challenge Card is "a printed grid of word pairs — no phone, no app, no network." Avatier says its deviceless MFA "resolves three independent factors — all locally, all without a device, and all in under 10 seconds":

1. Challenge Card Factor. "A printed grid of word pairs. At login, the system asks for a specific coordinate — the user reads the answer directly off the card."
2. Private Knowledge Factor. "A short PIN that only the user knows. Bound to the card via policy and verified in-memory."
3. Identity Anchor Factor. "The user's directory identity — Employee ID, badge, or SCIM-provisioned principal." Avatier says it "Ties the challenge to a specific human, with full audit trail."

The rule is "All three factors required," and Avatier adds that "the word and PIN must both be correct to gain access."

In NIST's vocabulary, the printed card sits closest to something you have. NIST describes a look-up secret as a record of secrets where "the verifier could ask a claimant to provide a specific subset of the numeric or character strings printed on a card in table format," and classes it as "something you have." The PIN is something you know. The third factor is different: it's Avatier's identity anchor, which NIST's three types don't name. It's the user's directory identity, not a biometric.

The card's three factors: a printed grid you hold, a PIN only you know, and your directory identity.

In practice, at login, Avatier describes the flow this way: "The screen types out a coordinate. The worker reads the matching word off the printed grid, then adds the private PIN. Directory Identity resolves automatically, nothing to approve." The same card works with or without a password. At a password reset, "your employee ID is verified automatically. Then, the password changes."

What an attacker needs: 2FA vs the card

To beat it, an attacker needs	2FA (password plus phone code)	Identity Challenge Card
Something you know	The password	The PIN
Something you have	The code, or the phone that receives it	The physical printed card
A third check	Nothing	The right directory identity
A value to reuse	An intercepted code, used in time	None; each coordinate value is one-time

For device-dependent MFA, Avatier's comparison lists "Push-bombing, SIM-swap, and replay" as in scope. Avatier's service-desk explainer also notes that texting a code to a caller's phone "assumes the phone is theirs. Not a device the attacker may already control."

The card changes what the attacker has to hold. It "can't be cloned remotely," the PIN is "never stored on a device," and the identity factor is "verified at the point of use." Avatier states that "Each coordinate value is one-time" and that used values "are permanently burned and never reused," with "No TOTP shared secret to exfiltrate." A lost card is not enough on its own: "Without the PIN it is useless."

Side by side: the two things an attacker needs for password-plus-code 2FA, and the three they need for the card.

What Avatier ships toward this pattern

• Identity Challenge Card™. The printed three-factor card for the service desk, login and password reset, deployed in under an hour with "No MDM, no app, no hardware." It ships in 34 languages. Avatier also offers it for Apple Wallet, Google Wallet or Samsung Wallet, "alongside the printed card, not instead of it." Government ID verification is coming soon. In Avatier's framing, the card defines the Identity Continuity Layer; see What Is an Identity Continuity Layer? For the product and a live three-factor demo, see the Identity Challenge Card.
• Strong MFA Login. Pillar 5 of Credential Governance™ binds a second factor, including Microsoft Authenticator, Okta Verify, Duo, RSA or the Identity Challenge Card, to every password authentication event. For details, see Strong MFA Login.
• The wider platform. For Avatier's AI-native identity platform, see the Avatier Identity Anywhere 2027™ preview. For the full product line, see avatier.com.
• Security posture. Avatier is SOC 2 Type II audited with no exceptions noted and ISO/IEC 27001:2022 certified. For details, see the Avatier Trust Center.