I would like to see it done via SIC. That makes the most sense. How does the bank know who you are? Obviously its done by SIC because you aren't entering any pin or anything (unless you have a cred chip). So it would make sense.. hell – it opens the ability to kidnap a corpie, rip their SIC, and install it in someone else and go drain the account. I love that idea.
