Some decent points, but if you require authentication for all transactions the man in the middle attack / trojan won't work. For every transfer have a SMS or phone call triggered to the customer--"We have received a request to transfer $x to Y, to authenticate please press 1." It may get annoying for every transaction, so it could only come into play for transactions to parties that you haven't dealt with in the last X days.