The nature of IFRAME object is such that it can only use a QueryString parameters to pass values to the iframe'd page. As a result, all these values are in the plain view of anyone vaguely familiar with HTML. So, yes - if you were to pass someone's name from IFRAME containing page to a page inside an IFRAME, you'd be passing it via SRC attribute of IFRAME tag.
On the other hand, the page inside IFRAME is independent and doesn't need to pass anything to the containing page. So, your creadit card processing is as safe as the inner page's code.
Not sure what you mean in the last point, though. Can you explain it to me, please :) ?