I believe that cost is used internally for reporting. There is no special in validating that the price is less of greater. It will just create negative report.

In addition, there is nothing wrong with selling products at loss. This is common in some cases to attract customers to buy other things.

PCI is important this days, but is there much that needs to be done on the shopping cart side?
Aside from securing the data, encrypting or not storing credit cards, what other aspects are important.

We want to set a target for PCI compliance.   

This is great candidate for extension. 

No SSL required. Do you get any messages in your log after you access the Extension store?

http://forum.abantecart.com/index.php/topic,70.0.html

Price can not change on it is own, unless someone else changes it. I you sure that this was not changed by some other person?
Can you please confirm this still happen?

New release will be ready in 1-2 weeks

As for stable production release (v1.0) we target end of Jan 2012. 

Happy New Year to all!!

I guess, you can just follow any existing payment extension that is close in approach. Copy it and create an new one.
Many payment gateways similar in approach. But unfortunately, we do not know much about Indian payment systems.

If you are wiling to contribute this module to community, we can help you if you run into issues.