Could smart phones be used to provide a "have something" security model? Could an OTP generator like RSA SecurID do the trick? Let's say you enter two memoriz

Could smart phones be used to provide a "have something" security model? Could an OTP generator like RSA SecurID do the trick? Let's say you enter two memorized numbers and then the last two numbers on the fob to make the four digit PIN (you would not want the whole PIN to be on the fob). Bonus: you need to use it for web logon as well. Some customers will pay extra for such services. Potentially avoiding hassles like ATM fraud and identity theft in the first place is worth a small fee per month to me because of the massive timesuck that could take place if they happened.