Most British banks require two-factor authentication. My bank (Barclays) allows me to login without sending a password over the wire. I insert my debit card into a reader and enter my normal PIN, which generates a one-time password. The scheme is remarkably well-designed and defeats all of the usual attacks[1].

Crucially, I must generate a different one-time password using a different procedure if I wish to transfer money to someone I haven't previously paid. This essentially puts paid to phishing and man-in-the-middle, as an authenticated session isn't enough to do anything malicious; To steal my money, you would have to either completely break the cryptosystem, or convince me to enter your account number into my card reader to generate the necessary one-time password.

[1] http://www.barclays.co.uk/Helpsupport/IntroducingPINsentryfo...