Answering from the POV of a software engineer who has developed integrations for online payments with a couple of diferents payment systems (both direct with banks and through third-party systems like Paypal).
Depending on the payment system the web site is connected to, it is indeed possible to take the credit card info entered by the client, and charge a different amount that what is shown on screen.
Now, how is this different from giving them your wallet and expect the best? In other words, what prevents merchants to just take as much as they want from your CC?
If they are honest, it's the same thing that prevents them to do any other sort of frauds: their honesty. They just want to sell and have happy clients, not to mention there are numerous ways for the clients to claim and prove that the merchant made a fraudulent charge which could end very, very bad for the merchant.
If they are dishonest, what prevents them to do this is simply that it's too much hassle. To be able to connect to an online payment system, they need to go through a whole legal process, sign a lot of documents, and certificate their website with the payment system issuer to show that it is safe, it is not deceitful to the clients, and that the information they record from the client and the credit card (if any) is stored securely and won't be misused. Why go through all this to charge a little more during a transaction, when they could simply forge a fake online payment page, get all the info from your credit card, and then use it the way they want before you even realize your credit card was compromised?
By the way, this last scenario happens all the time, and it's part of the "phishing" practices that make authorities, banks, credit card issuers, your family and friends, and even random strangers from the internet, tell you to double check if the site is legitimate before entering any kind of sensible information.
Now, at the beggining of the answer, I mentioned that this actually depends on the payment system the web site is connected to. This is because there are actually 2 methods to perform an online transaction with a credit card:
- In one, the web site owner(s) develop all that is needed to ask the client for the card data, sent the data to the bank/issuer, get the response from the bank/issuer, and process the payment on their system; this is usually harder to do because all the responsibility falls to the side of the merchant so they have to make sure the system works correctly pretty much under any circumnstance
- In the other, the website simply tells the payment system "hey, this client wants to pay us $X amount with credit card", then the payment system takes control from this point on to get all the info needed from the client, process the charge, and then send only the confirmation info to the merchant so they can process the payment on their system.
If the website uses the first method, it falls into the honest "category" mentioned on the first part of the answer. If they use the second, there's no way they can perform any kind of fraudulent operation because they simply have no access at all to your credit card info; all the information exchange during the payment transaction happens between the client and the payment system, and all the merchant gets is a confirmation that the payment was approved at the end of it.