Chase Bank does something similar. If your computer isn't cookied, then you are required to perform some sort of identity authentication (voice, text, email, etc). I'm surprised more important utilities like email don't follow this concept... it would at least weed out the brute force attacks.