As an end user, how can I tell the modal dialog is actually my bank?

It looks trivial for the vendor to man in the middle attack.

I’d take my business elsewhere if presented with a UI from some random e-commerce site asking for extra personal information.