[mortehu]

A more sensible way to break it down is by "something you have" (phone or YubiKey), "something you know" (password) and "something you are" (face or fingerprint).

Username and password are both something you know, so they count as just one factor. A card on the other hand is something you have, so combined with the PIN that's two factors.