Hacker News Reader

If they haven't been redirected to their bank, verifying with their mobile banking app using a QR code will not work.

Can't the attacker just man-in-the-middle to the real bank, and show the QR code to the phone?

Does the entire transaction take place on the phone? I don't think that's a good option.

So I have to get out my phone every time I use my credit card on my computer?

Not credit card. Bank account. Webauthn/passkeys could also work for auth as they check the domain and can't be phished

That’s why we don’t pay 3%+ on all transactions

I get 3% cash back, though.