That's the thing, even if they use an IFrame, I am not supposed to check everytime. The only thing I should have to check is whether the domain name in the addr

That's the thing, even if they use an IFrame, I am not supposed to check everytime. The only thing I should have to check is whether the domain name in the address bar is the one of my bank for giving such confidential credentials. Because as a client I'm not supposed to know anything about wlp-acs.com or adyen.com or whatever site the merchant site redirected me to. Here the password they request is a lot more important than any one transaction would, as it allows full access to your accounts.