There are three ways to authenticate an identity: based on what he has (phone, a device), or what he knows (a password, a story), or, what he is (his fingerprint, palm scan). The last is unusable in a remote context.
Therefore, your question is about using an alternative to what you know. That is to say, to use what you have (usually time-limited). This typically involves tokens, or one time password.
Check out some of these: http://www.duosecurity.com/, http://code.google.com/p/google-authenticator/, and http://www.wikidsystems.com/.
They are as safe as having a phone (and losing it). It is quite friendly.