> There's far better ways to do it if you can use online - I submit my card number to them, they pass the card number, their account number, and the amount to my provider, I authorise they payment with my provider.

Visa does support this scheme and I hate it when it happens. I try to use my bank password the less possible. I also believe it's a huge phishing risk as people don't look at the URL.

I personally prefer that the bank assume the current risk. It's not like it's making them bankrupt to do it right now...