Comment by vkjv

FWIW, I just checked and they don't use an iFrame approach. This means their entire checkout page must be in scope for SAQ-D.