[ErrantX]

Pretty good now; the legislation mandates multi-factor authentication by the issuing bank. So customer has to prove presence directly with their bank to authorise the payment.

There is also dynamic linking (ie you are shown the amount but also a unique code that the payment requestor also showed you) so you are confident it is the same transaction.