That's always a risk so expect malware that will do this. If there is a "white list" only payment setting then no site gets money unless you explicitly approve it in your account, as long as that can't be manipulated by third parties as well.

Systems that will time-gate your payments so that it's not per click or per visit while you receive notifications of each site you are sending money to can also help reduce the risk.

Nothing is risk free though.