What a brilliant idea. The only flaw I can see here is if the passcard, (which would need to be stored in a db somewhere) were compromised along with user login information.