AOL offers two-factor authentication.

The next time America Online (AOL) subscribers log into their account, they may need more than their password.

With a new, optional log-on service, AOL has become the first major U.S. online business to offer customers a second layer of security. There is a $1.95 one-time fee and a monthly fee of $9.95 for the two-factor authentication scheme, which is targeted at small businesses, victims of identity theft, and individuals who pay bills and conduct other financial transactions through their AOL accounts.

When they subscribe, users will receive a matchbook-size device from RSA Security Inc. displaying a six-digit code that changes every minute. The code is necessary to log on, so even if someone guesses or steals a password, they cannot access the account without the device in hand.

According to the Associated Press, two-factor authentication--in the form of the RSA device, biometrics, or cards printed with rotating lists of passwords--is common in Scandinavia, Brazil, Singapore, and other countries. In the United States, its use is largely limited to employees remotely accessing office networks and high-value financial portfolio trading.

By requiring a second, rotating password, "you don't have to remember complicated passwords to still have good security;' says Scott Schnell, a senior vice president at RSA Security. The second password will be required for checking e-mail and accessing services tied to the AOL account, including calendars, stock portfolios, and AOL's Bill Pay, but not to use AOL Instant Messenger. It will not protect services offered by third parties outside AOL's walls except in cases where their statements and other sensitive information are sent to the AOL e-mail account.

Analysts say AOL's offering likely will prompt other Internet service providers and banks to seriously consider such systems, though customers may find them difficult to use.