An organization is employing multi-factor authentication (MFA) for accessing its secure database. Among several authentication methods, a voice call is received by the employees to provide an additional layer of security after inputting their passwords. This phone call delivers a one-time code which the employee must then enter to gain access. Which of the following is an accurate rationale for using phone call-based verification in this scenario?
It is categorized as 'something you know' because it involves remembering the code delivered through the call.
It serves as 'something you are' because it uses the employee's voice recognition to validate access.
This method is classified as 'somewhere you are' since receiving a call can indicate the user's geographic location.
It qualifies as 'something you have' because it utilizes the physical possession of a phone to provide a layer of security separate from knowledge of the password.