You are confusing the question of whether or not a phone is an object that may be physically possessed with how that object is used.As noted at two factor authentication, the three types of factors are knowledge (something you know), possession (something you have), and something you are.The typical example of "something you know is, of course, a password.Both a phone and a physical key are object