SSL is probably not the most "efficient" way, but I'm not aware of any alternative that would be worth going to.
Mobile devices had WTLS to streamline the process for lower-bandwidth devices, but that's not a very viable system... While you could roll your own, the rule of thumb (for crypto) is never roll your own.
Flaws have been found in SSL, and addressed; and they will be again. However, your bank and your credit card company still use SSL, because it's the only widely supported method of providing reasonable security.
If the server in your case is hosted by your payment provider as @CodesInChaos suggests, they most likely only support SSL. If you're planning on terminating the encrypted connection on your own server... you should use SSL or expect massive hassles with your PCI (DSS and/or PA-DSS) certification.
In short... Just use SSL.