[ericd]

What about a script injection to rewrite the DOM and create a mock WePay iframe that's actually loaded from a third party server?