My bank (a credit union actually) requires you to come in to a branch office during normal business hours if you need to get your password or ATM PIN number changed, or if you've tried the wrong password too many times and locked your account.

They also use two-factor auth on logins from new computers (or when you've cleared your cookies).