I agree to some peoples' comments here.
It's pointless having two passwords because:
1) It's tedious work doing it over and over for those who aren't stupid enough to hand out their passwords.
2) Who says that this one won't be handed out as well? If someone offered me unlimited bs and I didn't have a brain, I'd give them both regardless.
There's got to be another way to fight account theft and this, in my opinion, isn't the solution.
EDIT: Perhaps you could implement a choice to bring in a 3rd person into the trade. To watch the process and take screenies?