• Man-in-the-Browser (MITB) attacks are unlike other attacks, in that the browser itself has been changed through a virus, browser help object, user script, or Active X control.
• The "virus" is downloaded by the end user, it then "infects" the browser, and then the browser looks for specific web sites and intercepts the communication between the user and the web site.
• There is no way for the server to detect a MITB attack.
• The end user can only detect a MITB attack if they notice a difference in the normal behaviour of the web site. Unfortunately, since the end user will normally trust the site, like their bank, and sites often change their look and feel, its very difficult to detect when a MITB attack is occuring.
• The only failsafe way to intercept MITB attacks is for the server to use another device for confirmation of the transaction details.
• For example, if you enter a money transfer into your bank site, the bank should send you an SMS message with the amount and account number of the transfer, and you must reply to that SMS to validate the transfer.
• Reference: entrust.com March 2014 pdf

Edit: As of 2020, almost all banks are doing 2-step verification now for exactly this reason. We are conflicted about whether or not to require 2-step verification before showing passwords, since the banks are protecting transactions with it. And we don't allow cross tab communication. So we are enabling 2-step verification as an option, you can either turn it on, or leave it off within 3rdKey.com.