Yes - and if you look at the source URL (mostly hidden if they use an iframe, or sometimes visible if they do a complete page redirect), then the hostname is of

Yes - and if you look at the source URL (mostly hidden if they use an iframe, or sometimes visible if they do a complete page redirect), then the hostname is often a completely unrelated, unintelligible name that no-one would associate with either the shop or the card company. These are exactly the websites that you should NOT trust!