There was a good thread about this a couple months back on 37Signals blog (http://www.37signals.com/svn/posts/753-ask-37signals-how-do-...):

The thing to note here, in my opinion, is to not implement it as they have. Do not store the credit card numbers on your own system. Instead, read through the comments. A few people talk up TrustCommerce (http://trustcommerce.com/), and it looks pretty good .

Note: I've never used it, just pointing out what others said. I do plan on using it sometime, however.