I guess it would be easier to establish a secure connection with the bank (whoever holds the details of the card  and perform the debit). and then upon confirmation of the card details, create a secure two phase commit transation with bank and the produce provider for further processing. you can make this completely transparent from user's view.

Make sure what secure technologies are supported by the bank (card issuer), the first think  comes to mind is SSL.