> My banks as for a password in that iframe. Not done type of one-time-code. Maybe there's an option for this that a bank can choose when "enabling" 3D Secure?

> My banks as for a password in that iframe. Not done type of one-time-code. Maybe there's an option for this that a bank can choose when "enabling" 3D Secure? Seems stupid, though. Never experienced it personally. > If it was just an OTP why would yhe iframe even be necessary? 90% of 3D Secure isn't the user interaction, it's browser integrity checking and permacookie-based submission deduplication. Essentially the iframe delivers a payload similar to the one used by Cloudflare Turnstile. That kind of thing could run in the context of a website (like Cloudflare Turnstile does), but it's a lot easier to manage when it's on its own secure origin without other scripts able to mess with it.