The free service, called SiteKey, uses technology from PassMark Security. Customers pick an image, write a short phrase, and chose three challenge questions. The data is exchanged with the bank to confirm identity.
Bank of America, which has 13.2 million online banking customers, claims that it is the first major financial services firm to offer this kind of added security.
The bank plans to launch the service in mid June in Tennessee and then roll it out across the rest of the country by the end of the year.
Even if a customer's ID and passcode have been stolen, SiteKey helps protect the account because the thief would have to answer a challenge question correctly to access the account, according to bank officials.
SiteKey also confirms the website's validity. When a customer logs in, they can click on the SiteKey button to see their secret image and phrase to confirm that the site is the legitimate Bank of America site.
While it rolls out the new service, Bank of America is notifying 60,000 of its customers that their personal data was stolen by a criminal gang involving employees at multiple banks.