Authentication on IoT devices has to work under tight limits on processing power, energy and response time, and many existing schemes either load the device too heavily or depend on one trusted server. This paper proposes a multi-factor authentication (MFA) framework for IoT that combines virtual smart cards (VSCs), QR-code login, fog computing and a permissioned blockchain. Heavy verification work is moved to fog nodes, and only the important events are written to the ledger, which keeps delays short and makes tampering detectable. We evaluated the design in a Python simulation. Authentication took 194.7 ms on average and registration 104.8 ms, and the system handled about 95.39 authentications per second. The cost on the user side stayed small, about 55 ms of device processing per login. We also checked the protocol with the Scyther tool; it found no attack on the stated secrecy and authentication claims, a model that covers replay, impersonation and man-in-the-middle attempts. Against recently published blockchain-based schemes, the latency is competitive and the feature set is wider, mainly because login is passwordless and user anonymity is kept. The results suggest that the framework is practical for real-time IoT services such as healthcare and smart cities, although tests on real hardware are still needed.