The image is a way for the user to "manually" authenticate the server. It's a weak authentication because an attacker could easily get a copy of this image once

The image is a way for the user to "manually" authenticate the server. It's a weak authentication because an attacker could easily get a copy of this image once he knows the user identifier and forge a apparently valid page. The most secure authentication is the one using security cards/key with a challenge code sent by the bank and the response returned by the key using bi-key cryptography. The one with usb connections would be most efficient, convenient and secure. Nfc on phones may look more attractive, but phones are insecure.