Static passwords are not the solution, fixed questions as well are not the answer, and biometrics are not the answer. The world of digital security is different from the world of physical security; data on the network/internet can be captured and retransmitted as they are in digital format.

If I use a biometric fingerprint scanner or retina scanner, to authenticate me on a PC, the resulting information will be sent from the PC to the banks server in IP, even if it is encrypted, it can be reproduced, by a phishing site or even by a simple sniffer on the network, 3DES & AES can be broken, it might take a while, but how changes his/her finger print?

The best solution from my point of view is in a PKI solution utilizing Digital Certificates and one time password tokens.