The second factor is the password that activates the token - something you know . The password that activates the token is used only to authenticate the user to the token. If you don't know the token activation password, you can't use the token. An example of a common hardware token is a bank ATM card. If you lose your card, no one can use it because they don't know your PIN or password.
Network administrators can hold users responsible for reporting lost tokens.
If the user does not report the token is lost, they are liable or responsible for all activity that took place. Even if they report the token lost, they still can be held responsible because the token can't be used without the password. Once the user has logged into the software token, challenges can be automatically processed into responses. Software tokens do not require the user to carry anything and are easier to use. They do lose the benefits of two-factor authentication.