- All information is supposed to be more or less secret, including the card number, your PIN, etc. Even the name of cardholder.
- No static (that is, usable more than once) information can be considered "what you have", they're all "what you know".
- "what you have" could only be something physical that's not easy to duplicate. The proof of having what you have is usually one time password generated using such physical object. Examples:
- an indication of a hardware token (proof of having the token)
- a communication with secure element, chip (proof of having chip card in a reader)
- a one time password generated on the server side and delivered via side channel (proof of having access to that channel). In 3d-secure the object is your mobile phone (your SIM card, to be specific) which it gives you access to the channel (your phone number). The channel is reasonably secure and access to it is reasonably limited, so it can be assumed that you having access to the channel to read the one time password is good enough proof that you physically have the SIM card.
Now, to have 2-factor you're supposed to both know the secrets AND prove your recent access to the physical object. The "recent" part can be implemented in many ways, eg by the token having internal clock that changes indication every few seconds, or via challenge-response mechanism.
Ultimately one can say that even the physical object is just information: the secret keys hardcoded in chips. But in security the difference between information and object is that information can be easily copied, while an object cannot. Fun fact: keys to your house are more information than objects, as it's quite easy to make copy of them.
If you want to do only MOTO transactions, the card doesn't even need to exists physically. There are examples of banks issuing "virtual cards" for internet use only, and those "cards" are just a bunch of letters printed on a paper: card number, expiry date, cardholder name, etc. Because they're not supposed to be used in card reader, there is no need nor use for mag strip, chip or embossed letters.