Sorry to disagree with you, and answer my own question, but here is the answer copied from the web
:eyebrows:
"Banks like BoA use a risk-based decision engine that examines several variables, including but not limited to:
Your visible IP address
Your brower's "signature," which incudes the user agent header and detectable display properties such as screen resolution
The presence of a persistent cookie
The presence of data in another persistent store, such as a Flash wallet token
The risk engine uses the above data and compares to various risk rules that are configured by the bank. Rules include IP geolocation and blacklisting, known browser security issues, and risk exposure particular to your profile (e.g. if you are a high wealth customer). The risk engine calculates a score and decides whether the prompt you for a second factor of authentication, which can sometimes be a one-time password or a KBA (knowledge based authentication) question (e.g. the name of your first pet).
Some banks will do this check only when you sign on. Other banks perform a contetxt-sensitive risk check with each and every transaction, e.g. if you are wiring a million dollars to an external account you are higher risk than transferring $10 to your loan account."