I like the "transfer pin" idea. Adds some pain to transferring that I'm not sure I'm willing to take on though. Think if it from my perspective (ASICMINER-PT) or Deprived's perspective (DMS.SELLING, DMS.MINING, etc.) ... we do 1000's of transfers. In Deprived's case he's watching transfers come in, which gives him an account id, then transferring back an appropriate number to the same account. Adding a stage where he has to contact the user and request their private transfer PIN would be a deal killer.
Yeah it would be a total pain for me. I get the user ID to send to from the list of who transferred. I use copy/paste to put in my own transfer out so there's minimal risk of me sending to the wrong person. I can, of course, get the quantity to send wrong - but a pin wouldn't change that. Obviously I wouldn't object to a pin being added if it was optional.
I plan to automate the exchanging eventually (it can't be done right now even if I had the time - as API doesn't currently provide sufficient information : it lacks the identity of the sender so a bot wouldn't know who to send back to) which would be impossible if there was other information required beyond identity of sender.
Not sure how many transfers I've done for DMS but it must be getting towards 1K sets of paired transfers. Only errors so far (other than missing a few - which were all caught up with either when my daily audit caught the error or when the user PMed querying) were a couple of occasions where I failed to send 1 of either Mining/Selling (probably clicked transfer instead of pressed yubikey and didn't notice) and one where I sent too few of one. Oh and on a few occasions I mistakenly sent mining rather than purchase when doing swaps in from my personal account - just force of habit there I guess.
Copy/Pasting name to send to from wherever it originated rather than retyping it is best protection by a mile.