2

I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details.

Currently it's set up to appear like it's the same site. The only issue is that I obviously don't get the green bar, even though it's totally secure. I've put the word "secure" with a lock logo in the header.

How can I give the user a feeling of security and trust in this context?

EDIT:

First and foremost, thanks for your answers.

A little more context regarding why I'm using an iframe: I've got a site builder for ecommerce, and my customers get a subdomain of my domain and can also add their own domain on top of it. Custom domains are a majority, and there's no simple way for them to set up SSL.

I'm currently adding credit card support (I originally use PayPal) and wanted to make it transparent. In the option I'm currently using the iframe is hosted on my own domain so I can control the SSL there. From your answers, the alternative would be to actually redirect to my site for payment, similar to going to PayPal. I can make it clear that they'll be redirected to another site and I won't have to "fake" that the site is secure. The only caveat is that they actually leave the site, and I feel that at least my customers won't be happy about that.

Improve this question

5 Answers 5

Reset to default
7

We've been telling people to look for the lock in the address bar and to mistrust anything that says it's secure but doesn't have the lock. Any way you look at it, it's going to look like you're phishing and no amount of design is going to help you with that.

That doesn't mean everything needs to be on SSL. Amazon isn't but takes you to a secure server for sign-on and payments. If you're just going to put SSL on the payment process, why don't you do this on a subdomain (secure.company.com)? Announce you'll be doing so ("click continue to go to our secure payment server") to prevent any confusion. But you could make that totally seamless as well (again, look at Amazon). Around here everyone is totally accustomed to the payment process being separate and extra secure.

Improve this answer
4
  • 3
    I would add to this that putting a lock logo on your own site should make a user feel less secure, as you're basically using all the tactics of a phisher. When you redirect to the payment provider, make sure that both pages refer to each other. Make sure you prepare the user for the switch to another page and make sure the other page shows that it's communicating with you (eg. it shows your logo andthe item they're paying for).
    – Peter
    Commented Apr 10, 2013 at 9:39
  • I concur with Peter. A common way to prepare the user for the switch is to use a "Pay with" button to transition to the payment processor. For example, a site using Amazon.com as their payment processor would use Amazon.com's "Pay Now \ Amazon Payments" button. Such images are provided by most payment processors and may foster trust by associating your payment process with a well-known brand.
    – Brian
    Commented Apr 10, 2013 at 13:04
  • Hey @Koen, thanks for the answer. I just edited my question to provide more context.
    – ben
    Commented Apr 10, 2013 at 16:04
  • If I understand correctly, the e-commerce site that will use your checkout feature could be on pretty much any (sub-)domain. I think the general point of my answer still stands: you have to make clear the payment is secure and you need to do that in a way people can confidently judge this security by themselves (ie. take them to a secure domain). The only real option I can think of is to present this just like any other payment provider (Mastercard secure card, Ogone, Buckaroo, Paypal): on its own domain. Perhaps my creativity fails me and there is another way?
    – Koen Lageveen
    Commented Apr 10, 2013 at 18:22
2

The only way to make your users feel secure is to implement SSL the right way. Having a lock icon along with secure anyone can do. If it's not secure, as in having implemented SSL the right way - don't try to fool your users that it is secure. That would only make things worse.

If your SSL fails, this screenshot may be what the users get in return. No way they will ever trust your site with credit card details again.

enter image description here

Improve this answer
0

Text regarding mastercard/visa/paypal protection is a good (no, GREAT) way to begin, and in the context e-commerce, you want to avoid anything that could decrease your conversion rate.

If you're finding that many users are abandoning their shopping cart and you've identified that it is a trust issue, you may want to try reassuring them by providing a physical (retail?) presence, and some real-world contact information.

By exposing your real identity to real-world interactions, you bring the e-commerce out of the cloud and back into the physical world.

... At least, in their mind.

Improve this answer
0

First of all - why do you need to use iframe? Or any redirection to 3rd party services. In eCommerce simply you are loosing on conversion.

There are easy to implement solutions that gives you payments with credit cards that are perfect for UX, security and keeping sales high.

Check:

  1. Stripe and it's checkout
  2. SecurionPay's checkout or custom form
  3. Braintree Drop-in or custom

You keep users on your side, have full control on their behavior and can increase sales.

Redirection or iframes are literally old-dated models of credit card payments.

Improve this answer
0

On a site where SSL is not possible it's best to create a separate site with a single page that houses the code (iFrame) for the checkout process. This page is referred to as a hosted payment page and commonly utilizes the 3-step-redirect method for integrating a payment gateway.

https://wiki.paykings.com/three-step-redirect-api-overview/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.