One important thing about factors is that they are independent of each other.
The fact that a person has a particular password bears no relation to the fact that a person has a particular fingerprint ridge structure.
And even modalities within a factor may be independent of each other. When Motorola sold its Biometric Business Unit to Safran in 2009, I joined a company (MorphoTrak) that promoted three biometric modalities: finger, face, and iris. While all three biometrics came from the same person, there was no relationship between any of them. Knowing a person’s right forefinger did not tell you what the person’s iris was like. (But beware: driver’s licenses and passports share information, such as dates of birth.)
If you have a critical security issue, you don’t want to depend upon just one factor, or one modality.
Double or triple them up by requiring multiple identity verifications and authentications with unrelated modalities and factors.
Bredemarket 