1. A method to implement multifactor authentication of a user with a wearable electronic device of the user, the method comprising: performing biometric authentication of a person that bears the wearable electronic device, including: receiving one or more first biometric signals generated by one or more sensors of the wearable electronic device, the one or more first biometric signals indicative of one or more person-specific biometric characteristics of the person; determining the one or more person-specific biometric characteristic of the person from the one or more first biometric signals; comparing the one or more person-specific biometric characteristics to one or more user-specific biometric characteristics of the user determined from one or more second biometric signals generated by the one or more sensors of the wearable electronic device at one or more previous times when the wearable electronic device was borne by the user; and based on the comparing, determining a confidence level that the person is the user to determine a positive or negative biometric authentication of the person as the user; presenting an access control token of the wearable electronic device to an access reader that performs token-based authentication of the person, wherein the access control token presented to the access reader is an authorized access control token and the access reader is configured to grant the person access to an access-restricted resource based solely on the access control token being an authorized access control token; in response to the confidence level being below a threshold confidence level, causing a challenge question to be presented to the person; making a positive authentication of the person as the user in response to receiving an answer to the challenge question that matches an expected answer to the challenge question; making a negative authentication of the person as the user in response to not receiving an answer to the challenge question or in response to receiving an answer to the challenge question that does not match the expected answer; granting the person access to the access-restricted resource based on the access control token being an authorized access control token even when a negative authentication based on biometric authentication and/or knowledge based authentication occurs; and in response to the negative authentication, triggering a followup that would not be triggered absent the negative authentication.