Payment platforms are trying to allow merchants to defer sensitive part of their payment interactions to those platforms. This is a typical design that those platforms serve Payment Request API through an iframe and make it look as if it's a part of the merchant's website, but actual sensitive information handling is done by the platform.

This strategy works quite well because merchants can take advantage of Payment Request API's benefits yet can easily implement the feature through those platform's SDK.

But if you look closer to what Payment Request UI saids when paying with `basic-card` and entering CVC code, it saids: "Once you confirm, your card details will be shared with this site.". (see attached image)

For users it sounds as if their credit card details will be passed to the merchant, but in fact it's passed to the platform. Some merchants concern about this and want to clarify that they are not actually handling those info.

Can we rephrase the note? Perhaps something like "Once you confirm, your card details will be shared with https://payment-service.provider"?