This is basically what's happening in S.Korea. Instead of investing more in security, banks are offloading the duty to the consumers. They issue a private key and ask for three different layers of password/pins nobody ever remembers. If you (or the bank) ever get hacked, well, you can't prove that it wasn't you "so too bad" is basically what happens.