My bank requires both my pin (numeric) and password to log into my account, and SMS's me when I login. If I need to transfer money to anybody outside of my usual payment recipients it SMS's me a token that I have to enter.

That's not failsafe but it raises the bar quite a bit above 'enter password to own everything'. Also, no extra hardware required.