My bank has fairly lax login requirements (account ID, some random digits of a N digit PIN, some random letters of a longish password.
But to make payments to new accounts, you have to add that account to your approved list, which involves inserting your debit card into a little calculator-style reader, entering your (different) PIN, and then doing CHAP style auth with a random number supplied on the webpage, which is (hopefully decently crypto) mangled by the device, giving you a confirmation code.
It's a bit of a hassle when you need to send some money to someone quickly and can't find the little machine, but otherwise, I think it's a pretty decent level of security.
