POLi Payments is an Australian based online payment provider which has begun trading in New Zealand. They are supported as a payment option on some large eCommerce websites in New Zealand, including Air New Zealand, JetStar and The Warehouse.
It basically facilitates the verification that, as a customer, you have made a payment from your internet banking facility, so that the vendor may immediately complete the transaction.
It is highly attractive, because airlines do not charge a 'payment fee' when using POLi (which usually accounts for between $10 and $20). I am concerned with how it achieves this.
As an ANZ bank customer, after visiting the Air New Zealand website, I chose the 'POLi' payment option, and I was (while still on the Air New Zealand website), presented with my internet banking login page. So, to be clear, the address bar contained "airnewzealand.co.nz", which had an iframe, whose address was pointing to "https://nz00400.apac.paywithpoli.com/IBCS/pgLogin". I was then expected to log in to my internet banking, at which point I was presented with the pre-populated ANZ bank-transfer web page, with some fields disabled (reference code, amount etc).
What was being done is, the POLi server was requesting the bank website from the ANZ server, massaging the HTML, and passing the HTML to me. I then fill out the form, which is submitted back to the POLi server, who then passed that information back on to ANZ again. This was repeated for every page.
Because of this, POLi was able to
- pre populate the payment form so that I don't get the reference code or amount wrong
- disable fields so that I cannot change them
- validate the payment as completed so the transaction can continue.
What, if any, are the technical and social security implications of this technique?