I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details.
Currently it's set up to appear like it's the same site. The only issue is that I obviously don't get the green bar, even though it's totally secure. I've put the word "secure" with a lock logo in the header.
How can I give the user a feeling of security and trust in this context?
First and foremost, thanks for your answers.
A little more context regarding why I'm using an iframe: I've got a site builder for ecommerce, and my customers get a subdomain of my domain and can also add their own domain on top of it. Custom domains are a majority, and there's no simple way for them to set up SSL.
I'm currently adding credit card support (I originally use PayPal) and wanted to make it transparent. In the option I'm currently using the iframe is hosted on my own domain so I can control the SSL there. From your answers, the alternative would be to actually redirect to my site for payment, similar to going to PayPal. I can make it clear that they'll be redirected to another site and I won't have to "fake" that the site is secure. The only caveat is that they actually leave the site, and I feel that at least my customers won't be happy about that.