When talking about two factor authentication, I never use the official terminology. I call them passwords and hardware devices.

I've seen implementations where "something you have" was a piece of paper with passwords written on it. That is not an extra layer of security, that's five seconds extra at the photo copier when the thief is copying the piece of paper with the regular password.

And "something you know" still makes people think that a password should not be written down. Sure, that's how it used to be when people had one six-character password and a four-digit pin. But these days passwords are 12-20 characters, and people have 17 passwords for social media alone, plus every online store, forum, and sometimes even download sites, that's hundreds of random strings.

There are no alternatives to writing passwords down (paper vs password manager has good arguments for either), and writing down passwords does not make them something you have.

As for biometrics, I'm not convinced that was ever a good idea. There are way too many problems, some of them with no way to solve. So I tend not to suggest that at all.