Attacker's page sends
Bank's cookie setting
Bank's server

Ana's balance: 1000 coins

(no request yet)
Press a button to send a request.

Tip: with SameSite=Lax, try the link attack while the bank also accepts GET.

The same request, sent from two places. Only the forged one should fail once a defence is on.