There is an interesting article talking about what we are really doing, which in the main is improving Google's AIs.
The real reason Virgin are using these is that they are a (dirt) cheap way of adding some form of secondary protection against brute force login attacks. Cheap in the sence of a day or so of development time.
At this point most companies are offering, or mandating, proper two/multi-factor authentication using SMS or other methods - as they should.
I much prefer these, and they are much more robust as a protection, but that would actaully cost some real development time and there is why we don't have it, Virgin don't like spending any money on anything if it doesn't add revenue units.
