Could you eliminate passwords altogether and validate via a back channel?  Have a service that ties a phone number and a credit card number together, and allow people to confirm purchases via SMS.<p>It looks like purchase notifications via SMS is already in play, not so sure if anybody has tried purchase authorizations yet.