Hmmm, how about paypal linked to a bank account? Just as bad probably. They have a two factor authentication available with your phone, but perhaps even that is a bad idea.