Micosoft Authenticator Configured so it reports application, shows a map with the location of the request origin, requires a two digit number to be typed.
Whole company is on an hybrid Azure AD so it's just the better choice in our situation because of that. We use Azure Apps to integrate it and Azure AD to manage permissions.
Can't speak for anywhere else, but can speak for personal experience, here in Italy "take the license plate" or "get in the police car and follow her" would be our procedure. She has not pulled out a weapon, and law enforcement is not supposed to escalate anything, ever. (Exceptions might apply, poorly trained officers exists). Even if she pulled a gun, probably we'd just try to evacuate everyone in the area and call for reinforcements before thinking of pulling out our firearms.
On average we get 5 police deaths in a year out of about 300-350 thousands agents, so I guess it works well enough.
(and yes, I do realize that in US there's a lot of armed and trigger happy civilians, but that's just another issue to solve. If a civilian needs a gun for self protection , there's something really really wrong with society in my opinion)