Not even sure what three factor would be!

Biometrics are being harvested, so they’ll be easy to copy.

How do you prove ownership when nothing is provable?