I gave a talk on that almost 20 years ago...

Basically you have (1) something you know (like a password), (2) something you have (like some device or key), and (3) something you are (like a fingerprint and iris scan).

Back then the accepted trade-off was that have any two of these three is good enough for most case, and for really critical stuff you need all three.

The MFAs in question here attempt (1) and (2), but do a bad job on (2).