Norwegian banks have a common BankID scheme that's used for Verified by Visa.
The confirmation page runs a Java applet that first requires you to enter you personal ID no. (Norwegian equivalent of social security no.), and the prompts you for a 6-digit code from an electronic code generator and a personal password.
You use the same method to log on to your net bank, and requires another verification whenever you try to either pay something via the net bank or transfer money out of your account.
With this scheme, for a transaction to be completed, you need:
a) Your visa number.
b) Your verification code.
c) Your ID number.
d) A one-time code that can only be had if you physically posess the key generator.
e) Your personal password.
It works pretty well, and even works on a mac...