Comment by LelouBil

How is it not a second factor ?

It's something else that is unrelated to your password that you have to provide in order to log in, is that not the definition of a factor of authentication ?

Because it's phishable ?