diff --git a/internal/api/token.go b/internal/api/token.go
index 7d94af3445..b3baf0468f 100644
--- a/internal/api/token.go
+++ b/internal/api/token.go
@@ -309,6 +309,15 @@ func (a *API) generateAccessToken(r *http.Request, tx *storage.Connection, user
 	issuedAt := time.Now().UTC()
 	expiresAt := issuedAt.Add(time.Second * time.Duration(config.JWT.Exp)).Unix()
 
+	atLeastOneVerifiedFactor := false
+	for i := 0; i < len(user.Factors); i++ {
+		factor := user.Factors[i]
+		if factor.IsVerified() {
+			atLeastOneVerifiedFactor = true
+			break
+		}
+	}
+
 	claims := &hooks.AccessTokenClaims{
 		StandardClaims: jwt.StandardClaims{
 			Subject:   user.ID.String(),
@@ -324,6 +333,7 @@ func (a *API) generateAccessToken(r *http.Request, tx *storage.Connection, user
 		Role:                          user.Role,
 		SessionId:                     sid,
 		AuthenticatorAssuranceLevel:   aal.String(),
+		AtLeastOneVerifiedFactor:      atLeastOneVerifiedFactor,
 		AuthenticationMethodReference: amr,
 		IsAnonymous:                   user.IsAnonymous,
 	}
diff --git a/internal/hooks/auth_hooks.go b/internal/hooks/auth_hooks.go
index 7113344294..78be5c1653 100644
--- a/internal/hooks/auth_hooks.go
+++ b/internal/hooks/auth_hooks.go
@@ -104,6 +104,7 @@ type AccessTokenClaims struct {
 	AppMetaData                   map[string]interface{} `json:"app_metadata"`
 	UserMetaData                  map[string]interface{} `json:"user_metadata"`
 	Role                          string                 `json:"role"`
+	AtLeastOneVerifiedFactor      bool                   `json:"has_factor,omitempty"`
 	AuthenticatorAssuranceLevel   string                 `json:"aal,omitempty"`
 	AuthenticationMethodReference []models.AMREntry      `json:"amr,omitempty"`
 	SessionId                     string                 `json:"session_id,omitempty"`