Unless it's a man in the middle exploit but the presumption was that you're hitting a legit web site as opposed to some browser redirect.
Yep... the man in the middle, and high Jack website hacks work great... and.... but you have to know how to do it... OK I should shut up now.
Those are real And serious risks...
