[homakov]

No, since there's no way to check iframe's domain I don't think it can be fixed for iframes.

They should stop asking for user's password right there, because it makes people trust any iframe

[fatbat]

Maybe they can force login via their main site first. Lousier user experience though.

[moe]

Lousy user experience is not being able to verify what site I'm about to enter my payment credentials into.

[pbreit]

It would be a terrific experience if there was no reason to worry.