Passports are printed similar to currency. There are many features in them that are hard to replicate. It can be done but not easily, so it does fit the bill of "something you have" to authenticate. Not nearly as secure as a yubikey or an rsa token, but oh well.
