I cannot imagine why in the world you would have to use the symbol for punched cards. A punched card is an incredibly archaic form of information transmission - that has absolutely got nothing to do with a mobile phone, and is 100% not used in a 2fa system! Software marking is usually rather lenient. I'd say that anything involving online display or telecommunications link is probably OK for that part of the flowchart. (System flowcharts as used in the HSC are pretty old, 2fa is a newer idea, they'd be a range of valid options).