If both are not required it's not a second factor. Two factor is something you know (password) plus something you have (a phone number).