[EGreg]

Why not have a two factor auth? Then loss of a smartphone won't be a big deal.

Or three factors: biometric / password on phone, show OTP to site, then enter some password in site