A challenge can involve asking the user about a knowledge-based factor, such as asking the user to: provide a password or PIN; answer a security question; identify friends in photos; answer a question about where the user was at a particular time/date, or who was with the user, optionally with photos. A knowledge-based factor can also involve asking a user: if they took a particular photo; about credit card charges or payment activity; about emails, text messages, or other communications; about information from their social media profiles or their résumé; to identify an item in a picture; or about the user's habits, behavior, or history. Responding to a challenge can also involve using biometrics to provide authentication, which may involve obtaining: a fingerprint or other biometric reading; facial recognition; an image of the user or user's surroundings taken by a device's camera; and a voiceprint.

Responding to a challenge can also involve using additional factors to authenticate, including: a text message/email/voice call; a challenge/response to a phone app; a photo ID (holding the user's license in front of a camera); a USB unlock key; a YubiKey; a U2F key; another device with a unique ID; a one-time-use unlock code; or an NFC “bump” between a wearable device and a mobile device.

The user can also use unique behaviors to authenticate, including: signing the user's name; saying a phrase; drawing a pattern; performing a personalized motion in front of a motion-capture device; and singing or whistling.