I'm pretty sure NoScript's ABE (https://noscript.net/abe/ https://noscript.net/abe/) would be able to reject those requests. You can basically define rules that

I'm pretty sure NoScript's ABE (https://noscript.net/abe/ https://noscript.net/abe/) would be able to reject those requests. You can basically define rules that say requests are only allowed to the credit union's origin and that's it.