> Most people that will be taking credit cards directly via a form like this will have merchant account and be authorized to use the credit card logos.
Using logos in combination with a credit card capture form comes with a different set of rules (and a different contract!) than just being allowed to use some third party processor that does all the work for you.
If you want to capture the cards yourself instead of outsourcing the job to an IPSP then you're going to have to be at a minimum PCI compliant. This goes for any company that stores, processes or transmits credit card information. The tipping point is somewhere around a million $ US per year. Below that the cost of being in compliance outweighs the fees the IPSP charges for their service handily.
The word 'credit' in credit cards stands for 'trust'.
https://www.google.com/search?client=ubuntu&channel=fs&q=ori...
People trust those companies and by extension trust those logos. That's why when you use them you will be held to the rules so strictly because credit card companies do not like it when their logos are used to give an aura of trust to an otherwise non-trustworthy situation. Just the PDF about what you can and can not do visually with the logo runs to lots of pages.
Yes, there are plenty of ways in which using those logos is absolutely ok, and where using this form is (probably) just fine.
Everybody that is PCI DSS compliant can likely use it without any problem. Yes, there are also plenty of ways in which using this form is strictly against the terms of service, typically this includes everybody who is not PCI certified, which is almost every two bit merchant on the web that outsources their payment processing and credit card capture to some third party.
So, if you use a 3rd party solution that serves up the payment form and that handles the card capture and subsequent processing for you and you have a contract with them rather than with the card company you can use the logos and nobody will care, mostly because you can't do much harm (such as your paypal example).
But if you are in a situation where you have a merchant account but you are not the merchant of record (this means you are a sub-merchant, such as when using any one of a number of IPSPs) then using this form is most likely not a good idea.
As for me backing up my claims, I'm not going to attach a copy of my merchant agreement to a comment on the web, you are totally free to disregard what I wrote. This advice is worth exactly what you paid for, and everybody that has a merchant account but is not the merchant of record (aka a 'sub-merchant' in payment processing lingo) is totally free to inspect their own personal copy and for everybody else this does not matter at all.
Further reading on the subject:
https://www.pcicomplianceguide.org/pci-faqs-2/
A list with a sample of payment facilitators (if you use one of these you are quite possibly not the merchant of record):
http://www.mastercard.us/merchants/accept-mastercard/payment...
Note that this is not an exhaustive list by a long shot.
The mastercard FAQ which has a nice little blurb about who is and who is not a merchant or record:
http://www.mastercard.us/merchants/assistance/faq.html
Also of interest:
http://www.mastercardbrandcenter.com/us/images/acceptance_ma...
Less interesting (branding, not acceptance marks):
https://www.mastercardbrandcenter.com/us/getourbrand/index.s...
Oh, and an afterthought: there is yet another important logo, the VBV one, you can only use this if you're actually part of the program.