Bruce Schneier has an interesting post (with many comments) on the role financial institutions need to take in the authentication of online transactions. The post links to an essay that suggests a variety of anti-fraud measures to protect against attacks that exploit weaknesses in personal information based authentication.
