This is really a complex question that requires a fairly comprehensive understanding of how SSL works. First, at the browser level, in some cases, there is a way to make a lock appear as a site icon rather than an actual SSL indicator.
Then, SSL doesn't actually indicate that you are talking to who you want to, but rather just that the URL the browser is going to matches up with the certificate that is presented by the host and that the certificate was signed by a CA that appears in your browser's trusted Certificate Authorities (which is a locally maintained list).
In order to be sure that things are secure, you should look at the certificate details to ensure they are valid and for the site you intended to go to. This can normally be done by clicking or hovering over the lock icon. You also should be aware that if your computer is compromised with a virus, it may be possible for an invalid CA to be added to the local store which could result in a false site being indicated as valid under the bogus CA.
As far as the actual communication goes, SSL will ensure that the communication can't be eavesdropped on, but the lock is not a strong indicator that you are talking to the correct party without doing some additional digging and being vigilant to ensure that your computer is in good working order and not infected with malware locally.