Some banks solve this problem by requiring a 2 factor auth to confirm transactions (even after logging in).