Sheila_H has some good advice about the padlock. Also look for "https" instead of "http" in the URL prefix for the payment page.
However, calling in an order only gives your credit card number straight to a person who you don't know.
If you have doubts about security (and that's a healthy concern to have), simply use a prepaid credit card or a debit card that is not tied to your primary account.