I'm currently volunteering at a nonprofit. While researching something unrelated, I noticed that a $sisteragency was using an embedded iFrame to accept online donations. While the frame's source uses HTTPS, the page it's on is HTTP.
$sisteragency uses third-party CRM software to handle donations, provided by $crmcompany. $crmcompany claims to be PCI compliant, but its instructions seem to be built around adding the iFrame to an insecure page. Its knowledge base contains a suggested message to show users that boils down to, "Even though you can't see the padlock or https in the address bar, the part of the page that captures your payment information [the iFrame] is secure." Their YouTube page has a video tutorial where they show the iFrame (with an https src) being added to an http page. Their site even has step-by-step instructions for responding to PCI compliance inquiries from a payment processor (as in, exactly what to enter in each field).
This all seems really shady to me. Couldn't a man in the middle attack modify the iFrame's src, since the containing page is http? Despite $crmcompany's claims, isn't $sisteragency also responsible for PCI compliance ($crmcompany says it is responsible for its clients compliance)? Is $crmcompany being negligent and/or noncompliant by providing instructions for embedded the secure payment system in an insecure page?
Basically, am I right to be so unsettled by all this?