Hosted fields
Card inputs that look like part of the shop's checkout but are really tiny iframes served by the payment provider, so the card number never touches the merchant's server.
The pattern is a truce between two bad options. Redirecting customers to an external payment page costs conversions; accepting card numbers directly drags the whole site into PCI DSS scope. With hosted fields the merchant designs the form, but the card number, expiry and CVV boxes are each loaded from the provider's domain. The shop's JavaScript only ever gets back a token to pass along. Braintree gave the technique its name; Stripe calls it Elements and Adyen calls it secured fields.
The payoff is as much paperwork as engineering: merchants can often get away with the shortest self-assessment, SAQ A. But the page around the fields still belongs to the merchant, and an injected script can draw a fake field right on top of the real one. That is why PCI DSS 4.0 started asking about the scripts on payment pages too.