What are the four categories of authentication factors?
- Possession, something you have (besitzbasiert): a token, smartcard or key.
- Knowledge, something you know (kenntnisbasiert): a password or PIN.
- Inherence, something you are (inhärent): a biometric characteristic.
- Behaviour, something you do (verhaltensbasiert): a typical pattern such as typing rhythm.
* Four factor categories; MFA means combining factors from different categories. *
The categories matter because they fail in different ways. Knowledge can be guessed or phished, possession can be stolen or lost, biometrics can be imitated, behaviour drifts over time. Combining two categories forces an attacker to succeed at two unrelated attacks, which is the whole point of multi-factor authentication.
Note that NIST SP 800-63 counts only three factors (know, have, are). It treats behavioural characteristics such as keystroke dynamics or gait as part of biometrics, so "something you do" falls under "something you are" there. Other sources add further signals such as location ("somewhere you are"), which are mostly used as risk indicators rather than as factors.
Go deeper:
Multi-factor authentication: Authentication factors (Wikipedia) — knowledge, possession, inherence and location, with examples.
What is Two-Factor Authentication? (Duo Security, YouTube) — a short animated explainer of combining factors.