my bank uses:

1. 12 digit pin / complex password

2. Physical reference card (like a puzzle game to answer on login)

3. Must reply to SMS to transfer funds / configure payments