Replacing payment pages with fake pages is one of the popular scams done by malicious actors. When visiting a phishing site, all personal and financial data is converted to a server that is controlled by an attacker.

https://cyware.com/news/hackers-target-third-party-payment-processing-page-to-phish-victims-b15b55c0