In this bank site I read the following lines
Item #2 - You will also need to create a "Security Word". This allows you to verify that you have reached our Internet Banking site, and not some other site. Every time you attempt to log in to your accounts, we will send you a graphical representation of the Security Word that you created. If you do not see that Security Word or it is not the one you created then you know that you are NOT at OUR site. If this happens, please contact us immediately.
It says that bank displays the security word so that user can know that if he/she has reached the correct site, but I don't understand how it prevents man-in-middle attack.
The attacker can ask victim to enter the credentials, which then it can use to send REST back-end request to original bank site, which will return an html containing the security word of the victim, which can easily be parsed and can be shown on phishing site. So how does this security word actually help?