Why not just offer what Blizzard does and if you are logging in from the same location on the same machine, don't even ask for the one-time password? They have had that in place for years now and I love it. Never once been hacked using it, either - so all those armchair security experts who have no idea how these systems work please give it a rest.