Let's take some examples:
- Pay Pal, Apple Pay (examples via Saferpay) - will not load in an iFrame
- Visa Checkout, Stripe (example), Saferpay (link above) - credit card data can be input in an iFrame
Is there any technical/security reason why payment service providers differ in their approach to restricting iframe usage for credentials/payment information input? Or this is simply difference in risk management (and its supporting technologies for fraud prevention), business decision or maybe a legacy (and non-secure) integration architecture?