Something you have plus 2 things you know does not turn 2FA into 3FA. It's still 2FA - it's just somethings you know instead of something you know.

3 FA is :

* Something you have (normally one OR MORE user IDs)

* Something you know (normally the associated password or passwords for the user ID(s))

* Something you are (normally biometric)

[edit: technically, it's multi-factor when using multiple user/passwords - here's a useful link https://pciguru.wordpress.com/2010/05/01/one-two-and-three-f...]