Both my banks do (European banks, specifically Rabo and ABN/AMRO).

These are still not immune to phishing attacks but it's a lot better than TAN codes or some other 'dumb' authentication scheme.

Typically these systems work in conjunction with pin-and-chip card, a small piece of hardware that generates the codes and a challenge / response system built into the website you use for the authorization.

Separate challenges exist for logging in (read access) and transferring money.