A website is asking for a password and also sending an authentication code to your phone. What factors are used in this multi-factor authentication scenario?