Brazil. In my country, technology is growing rapidly, but in an unregulated way.

On one hand, we have a modern banking system that allows instant money transfers to anyone at any time, and the government is developing its own cryptocurrency. With our electronic voting machines, the country knows election results within two hours after polls close.

On the other hand, each company, including those providing essential services, creates its own solution without any regulatory oversight. This fragmentation extends even to official government services.

In the case I mentioned, each private health insurance company freely determines its own procedures for patient check-in at affiliated clinics. With my insurance plan, my ID card is sufficient--for now.

Isn't a document (what you own) + showing up physically so you can be scanned by eyeballs already not 2FA? What better authentication you can get than that?

Only if the document or their system has a photo of you. Usually driver's license is used for this.

> Only if the document or their system has a photo of you. Usually driver's license is used for this.

In my experience, using the identity card is more common. Only drivers have a driver license, but nearly everybody has a identity card (and every identity card has a photo); and AFAIK, the identity card is one of the mandatory documents to get a driver license.

Not in the US at least. My driver's license is the only thing I have with a photo of me on it. There are state non-driver IDs but they're unusual to see.

The context was Brazil (see sibling reply a few levels up), and here indeed all identity cards have photos. Both the old per-state models and the newer federally standardized models have them, and nearly everyone has an identity card. It's not unusual to see identity cards being used everywhere; even some commercial buildings ask for (and take photos of) them from visitors (regulars have badges, and of course they had to present their identity card to get the badge).

The cynical side of me wonders if its not intended to work well

I don’t agree with the practice, but from what I understand, they’re trying to prevent clinics from scamming insurance companies by faking clinical visits. I've heard that this is a thing that happens here.

When the attempt to stop bad actors stops/prevents others from using it, the system is bad. Insert baby/bathwater or nose/face comments here

That was a bit difficult to parse, but I think you're saying that (some) anti-fraud systems can't afford false positives. And I would agree, point-of-use healthcare is certainly one of those systems.