RSA soft tokens require a PIN. Some versions it's appended to the code, some you enter it to get the code (both exist in my organization). So that's like three more factors right there.