First Direct do this (but they've been that way for ever) for phone calls (better than me reading out my full password over the phone) along with a couple of secret question answers (I'm pretty sure customer support can't see the whole thing).

Online they are now forcing a one time PIN from a token generated from amount + last four digits of destination account.