Also checking with dLocal as to whether they can enable

Looks like we can solve it for safari & chrome users with some CSS:

{
    -webkit-text-security: disc;
    text-security: disc;
}

https://stackoverflow.com/questions/17769429/get-input-type-text-to-look-like-type-password

In T332890#8731532, @Ejegg wrote:

Looks like we can solve it for safari & chrome users with some CSS:

{
    -webkit-text-security: disc;
    text-security: disc;
}

https://stackoverflow.com/questions/17769429/get-input-type-text-to-look-like-type-password

Not working - we can only pass a certain set of properties listed here: https://docs.dlocal.com/reference/the-fields-object#field-options

I also tried the dotsfont suggestion, and it seems that the '@font-face' definition in the outer frame's dlocal.css does not apply to the iframe, so passing in the font-family of dotsfont just makes the cvv field use the default serif font face.

Change 903742 had a related patch set uploaded (by Ejegg; author: Ejegg):

[mediawiki/extensions/DonationInterface@master] Mask CVV input on DLocal forms

https://gerrit.wikimedia.org/r/903742

Change 903742 merged by jenkins-bot:

[mediawiki/extensions/DonationInterface@master] Mask CVV input on DLocal forms

https://gerrit.wikimedia.org/r/903742