Possession Factor (Something You Have).

An authentication factor based on a physical or cryptographic item the user holds, such as a hardware token, smart card, authenticator app or registered phone. It belongs to the Identity & Access category of cybersecurity.

An authentication factor based on a physical or cryptographic item the user holds, such as a hardware token, smart card, authenticator app or registered phone.

The possession factor proves identity by something the user has. It includes hardware security keys (FIDO2/WebAuthn), smart cards (PIV, CAC), TOTP/HOTP authenticator apps, SMS or push-approved phones, hardware OTP tokens, and cryptographic keys bound to a TPM or Secure Enclave. Possession factors raise the bar against remote attackers because compromising a credential alone is not enough. Quality varies: SMS and email OTP are vulnerable to SIM swap and phishing, while phishing-resistant FIDO2 keys cryptographically tie the response to the legitimate site. NIST SP 800-63B classifies possession authenticators by assurance level.

Defences for Possession Factor (Something You Have) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Something you have, Ownership factor.