Also for consideration
Those sites that tie loginId to Device Id. A few financial sites track the login Id and Device signature to verify a user. User has to provide a sitekey or Device Id to verify the login Id when attempting to login from a different device.
Seems like a good deterrent scheme.