This is a good approach really, start from an understanding that no single factor can be perfect, but with two or three independent forms of identification you can be '90%' verifiable, and that's the best we can hope for.