**Yes, technically they can**. Nobody is stopping me as a software engineer from showing you a different price to what I'll eventually command the payment processor to take from your bank account.

You are safeguarded if [2FA][1] or [3D Secure][2] is triggered, because the bank would send you an authorisation code you need to enter to complete the transaction. The message containing the code would also state the amount that I plan to take from you.

To answer your question, technically it's possible. The card processor would drop me in no time as @littleadv stated above and I would be legally liable but it's still technically possible.

---

Just to be clear; @littleadv criticisms in the comments below are correct. You're asking 2 different questions and I'm only answering one of them. 

It's not the same as giving your merchant your wallet even though it is technically possible to charge you whatever amount I want regardless of what I'm displaying. I'm only answering the question: "...merchant technically can charge whatever amounts he wants regardless of "online website cart amount" when confirming payment?"


  [1]: https://en.wikipedia.org/wiki/Multi-factor_authentication
  [2]: https://en.wikipedia.org/wiki/3-D_Secure