The simplest security measure.
Why don’t more sites offer the ability to send you an email when someone logs into your account? name.com does it. I figure all banks should do it too. I don’t expect all sites to offer that feature, but at a minimum the ones that require explicit security.