[teeray]

I'm pretty sure NoScript's ABE (https://noscript.net/abe/) would be able to reject those requests. You can basically define rules that say requests are only allowed to the credit union's origin and that's it.