Citibank
According to the website for the country's largest bank, all someone needs to set up online banking and bill paying for the first time is a Citibank ATM card, the associated PIN used at the ATM and the number for one of the associated accounts. Anyone with a deposit account also automatically gets a free online fraud protection service called SafeWeb(r) (note the trademark), which entitles them to full coverage for certain types of unauthorized transactions but does "NOT cover losses arising directly or indirectly from the voluntary surrender of your password or Personal Identification Number (PIN)."

This would be fair enough, if only the language about what is and is not covered weren't so convoluted. What constitutes "voluntary surrender," for instance? And could someone please explain this sentence to me? If you learn that your Password or PIN is lost or stolen and don't contact us within two business days, you could be responsible for up to $500 worth of unauthorized online transactions that occur beginning on the third business day and the time you actually notify us (if the transactions could have been prevented by your notifying us.)

I also find it somewhat disconcerting that merely by having a Citibank account, which I do, all of this language seems to apply to me, even though I've never set up online banking.

The only mention of extra authentication I found was that, for "extra security," I could choose to be prompted for my ATM PIN whenever I logged on. That seems to me to make an ATM card less secure, not to make online banking more secure. In all, it's a disappointment, given that Citibank's brilliant ID theft ad campaign gave it such a head start in inspiring customer confidence.

Bank of America
Of the big three, Bank of America seems to have the most going on, security-wise. It's gotten a fair amount of attention for SiteKey, which is sort of a two-factor alternative. If Bank of America recognizes an online banking customer's computer, it displays a picture that helps the customer know he or she is at the right spot, not a spoofed site. If Bank of America doesn't recognize the computer (based on things like IP address), it asks an extra security question. SiteKey was announced a year ago, and the bank is still in the process of rolling it out. The site does a good job of describing how the technology works, although on my computer, an explanatory video wouldn't play through Firefox, only Internet Explorer.