There are three ways to authenticate an identity: based on what he has (phone, a device), or what he knows (a password, a story), or, what he is (his fingerprint, palm scan). The last is unusable in a remote context.

Therefore, your question is about using an alternative to what you know. That is to say, to use what you have. This typically involves tokens, or one time password.

Check out some of these: http://www.duosecurity.com/, http://code.google.com/p/google-authenticator/, and http://www.wikidsystems.com/.

They are as safe as having a phone (and losing it). It is quite friendly.