Iterate recommends implementing bank hosted secure payment pages or PayPal Website Payments Standard into a website. Thus transaction security is the responsibility of the bank or Paypal.