Merchants should establish 2FA - When and if a bank log-in is requested - the merchant knows what is occurring.