[efdee]

If they haven't been redirected to their bank, verifying with their mobile banking app using a QR code will not work.

[ars]

Can't the attacker just man-in-the-middle to the real bank, and show the QR code to the phone?

Does the entire transaction take place on the phone? I don't think that's a good option.

[cortesoft]

So I have to get out my phone every time I use my credit card on my computer?

[ptman]

Not credit card. Bank account. Webauthn/passkeys could also work for auth as they check the domain and can't be phished

[jbverschoor]

That’s why we don’t pay 3%+ on all transactions

[cortesoft]

I get 3% cash back, though.