> In fact, they've been trained to do that with services like Mastercard Securecode usually implemented inside a frame to "arcot.com".

Even worse, the domain used varies based on your card issuer so there's no consistency.