Isn't 3DSecure like this? If properly implemented (a giant if, there), the query to the payment provider would happen using client-side Javascript, so your credit card data doesn't touch the shop's server. Then a 3DSecure window from your bank pops up so you can confirm the payment.

The alternative, telling the user to manually go to their bank and generate a token for amount X, would lead to so many people not bothering, and to so many lost sales. Or copy-paste errors, because users are dumb.