The author probably meant "two-step" (out of band verification) rather than two-factor.