3D secure payments in Europe have been a standard for years - being presented with additional verification steps for online purchases.
Attacker cannot know who you bank with. Plus, most of the time the confirmation screens are something like confirming 2nd/Xth characters of your password/date of birth.
It looks trivial for the vendor to man in the middle attack.
I’d take my business elsewhere if presented with a UI from some random e-commerce site asking for extra personal information.