The other day I made a few purchases using a mobile phone app (Android). I used Paypal, but this could be applied to any payment gateway actually.
Thing is, the application was just opening a "Window" or popup asking for the Paypal details. I trust this app and know I was actually being shown the Paypal website in the popup, but there was no way (or I didn't find one) I could really confirm I was using Paypal and not a mock/phising Window just asking for my Paypal username and password.
What do you think would be a wise way to show it's actually Paypal (or other payment gateways) when you don't have a standarized trustful browser bar which may show the URL and/or https status?
I'm evaluating doing a custom non-web application for the (typically online) web store I run and I was wondering what would be a good way to do this, or at least good enough so that users would trust it without necessarily trusting my application.
I know it can be done with the standard in-app purchases API (Google Checkout in the case of Android) which would use the system's account so you don't actually need to enter your username and password, but what to do for other payment gateways?