Which authentication practice is being used when an organization requires a photo on a government-issued identification card to validate an in-person credit card purchase?

The scenario describes using something the person has (a government-issued ID card) to verify their right to use another thing they have (a credit card). This falls under the category of a possession factor, or "something you have." The physical ID card with its security features and photo is an object in the user's possession that is used to authenticate their identity for the transaction. The human verification of the photo against the person's face is part of the process of validating this possession factor.

B. Knowledge-based credential authentication: This involves "something you know," such as a password or a PIN, which is not being used in this scenario.
C. Multi-factor authentication: MFA requires at least two different factor types (e.g., possession and knowledge). This scenario uses two items of the same factor type (possession).
D. Biometric authentication: This involves "something you are," like a fingerprint or iris scan. While a photo is a representation of a biometric, the authentication relies on possessing the card, not a direct biometric scan.

1. National Institute of Standards and Technology (NIST), Special Publication 800-63-3: Digital Identity Guidelines, June 2017, Section 5.1.1 Authentication Factors. This document defines the three factor types: something you know, something you have, and something you are.

2. ISACA, CDPSE Review Manual, 2nd Edition, 2023, Domain 3: Data Protection, Section 3.3 Identity and Access Management. This section details authentication factors and methods.