With my bank that requires me to use a device they sent me (a hardware token), my bank card, my pin and a secondary authorization where I use the hardware token to process a challenge and then type in the response.