Remember the GiftCardMall credit card fraud I wrote about two weeks ago? It affected several credit cards I’d used at GiftCardMall, including ones issued by Chase, Citi and American Express. In each case, I called the credit card company to dispute the charges and order a new card.
After I reported the fraud, I thought I was done. What I learned was that fraudulent charges can continue on the old card number, even after you get your card replaced.
Fraud notification from American Express
Yesterday, I got a “Card not present transaction approved” email from American Express. I normally receive these after making online purchases. Except, I hadn’t made any purchases with the new card.
I logged into the account and noticed that the previously reported fraud charges were still showing up on the activity dashboard. They had not been refunded. My brother had some fraudulent charges on his Marriott Bonvoy card and those had been credited right away.
Furthermore, there were several additional fraudulent charges that had gone through after I reported my card stolen.
I tried to get this taken care of via live chat, which was a waste of time. So I resorted to calling American Express.
The runaround
After initially claiming that there had been no additional charges since my initial report, the rep said she would open up another fraud case. When I asked her for the confirmation number, she read back the same one I received for the previous case. I asked her to read off all the charges that were listed under that case number and – no surprises – she read back all the old fraudulent charges.
She hadn’t filed a claim and was just giving me the runaround. I asked the agent to once again submit another claim. A minute later she stated that it was done.
“Great! Can I have the confirmation number, please?”
“No. There’s no confirmation number for pending fraud cases.”
I had to check the number I dialed. Was this American Express or the Marriott Bonvoy line? I thought only Marriott members get Bonvoyed, but I guess not. I decided to deal with that BS later. At this moment, I needed her to send me a replacement card since mine was compromised.
“Recurring charges…will always go through, regardless of whether you get a new card”
Her answer? “Your card is secure. Those charges came through after we canceled your card. Recurring charges and ones tied to subscriptions will always go through, regardless of whether you get a new card.”
That leaves cardholders completely open to repeated fraud. Is the expectation really that I get on the phone once a month and report a fresh batch of fraudulent charges until eternity? Of course not.
I’m told that I need to call Amazon and tell them to stop accepting payments for any order placed using my old card number. Considering I threw the old card out after I received confirmation a new one was on the way, that’s a little hard to do. Besides, barring an airline mile promotion, I’ve vowed never to go dumpster diving.
I always thought American Express had it together on the security front. But to tell us that once a thief gets a hold of our card info, they essentially have a lifelong pass to make fraudulent charges? I can’t even wrap my head around that nonsense. What is the point of all this anti-fraud technology they keep investing in if hackers get handed a lottery ticket any time they get access to an American Express card?
Recourse
My only recourse at that point was to cancel the card. Which was fine because it’s the Marriott Bonvoy card and earning those points is not worth the hassle.
While the agent had me on hold to research a solution, I tweeted about this conundrum and Becky mentioned that American Express has the ability to block charges tied to the old card number:
Yes the same thing happened to me. You need to specifically tell them to refuse any and all charges on the old number. They can do it but no idea why it’s not automatic.
— Becky Pokora (@sightDOING) June 17, 2019
I asked the rep and she claimed it wasn’t possible. This was a person in the Amex fraud department. But considering she had gotten so many things wrong during the call so far, I hung up and called back. This time, I indicated that I wanted to close my account and was redirected to the retention department.
The retention rep confirmed that American Express can in fact block charges from cancelled credit cards or from specific merchants. I didn’t want Amazon blocked and I was concerned the old card number would be used elsewhere for “recurring” charges. So I asked her to just block the old card number.
It took about a minute and she confirmed that any attempted charges to the old card number would get declined going forward.
Takeaway
While I was grateful to take care of this finally, I don’t understand why this isn’t automatic. I get it – updating credit card information tied to recurring bills is a huge hassle. But not more of a hassle than having to monitor your account and report recurring fraudulent charges.
Securing a credit card account so that no one else can use it for unauthorized charges should be the primary concern. Not whether it’s a “hassle” to update your card number with various billers. The fact that the old card number wasn’t automatically blocked is counterintuitive to combating fraud. At the very least, customers should be clearly informed of this option.
When the agent rattles off all those disclosures at the end of the call, most people don’t pay attention. I could have sworn I heard something about updating my card with automatic billers, but apparently it was the opposite.
Furthermore, the Amazon charges that came through after I reported my card number stolen were not even recurring charges (i.e. Prime membership). They were for purchases. So the idea that only subscriptions would continue to get charged is not accurate. Or secure, since thieves love linking stolen credit cards to their Netflix and Hulu accounts. At least in my experience.
Anyway, if you’ve had credit card fraud issues after the alleged GiftCardMall hack, you might want to circle back with American Express. Ask them to block any attempted charges to your old card number. This really should go without saying, but apparently, you have to say it.
Ariana-
It is shock to read that amex is not leaving up to the expectations of high quality service, in the past when I’dhave fraudulent charges they immediately took care of them and I never had any recurrent fraudulent charges. I wonder if you should call again and ask to speak with a supervisor, sometimes that can help expedite a successful resolution.
Also are the charges that you are showing in the screen shot all fraudulent charges???
Regards
Joe
Yes, all the charges (aside from the GCM one) were fraudulent. The call was very frustrating and unfortunately the charges have still not been credited. My priority was to get the old card number blocked. Today I need to call back and get them to issue temporary credits for those fraudulent charges, as is the norm.
The company is not what is use to be. Globalization has hurt this company with cheap labor.
I was definitely disappointed with my experience. The agents were totally half-assing it.
Well this is the same company that makes $550 Plat holders speak to a computer so….
Sorry to hear that happened to you Ariana! I would also assume the old number would be blocked once fraud was reported! What a silly system!
Lol! Very true. In this regard, Chase has it together. So does Citi – they issued credits for the fraudulent charges within minutes and overnighted me a new card. Easy!
I live in UK my old Costco Amex was cancelled 3 years ago. While on holiday in Cyprus notice Charge from Amazon Prime subscription on my new card. The charges had been put on old Amex and wrapped to my new card. Complained to Amex CEO in UK money refunded and fraud investigation set up.
Pingback: Recap: Union Warns Members Not To Fly AA, Hertz My Car & More - Doctor Of Credit
I have recently found several unauthorized “recurring subscription” charges on my Amex bill. A couple of them were from services I use (e.g. Sirius XM radio) but they are billed through a Visa card. Amex offered me the same “let’s cancel that card and get you a new one, but don’t worry – you’re recurring charges won’t be interrupted” line. Puzzled by the rather obvious problem, I asked the obvious question – what good does that do? All of the half dozen fraudulent charges were different internet services and at least some (maybe all) were recurring. Two of the recurring ones were with SiriusXM for streaming services. The truly shocking development came when I talked to SiriusXM and they gave me the rest of the billing details that had been provided with my credit card number for those two accounts that my Amex number was used to set up. Those accounts had different names, billing addresses and even expiration dates than my Amex card!! I couldn’t believe the charges were ever accepted by Amex in the first place! It appears as if someone simply made up an Amex number that happened to match mine and then a bunch of other non-conforming details and Amex just merrily passed the charges on to me on my bill. Wanting to hear something more reassuring than this was looking, I called Amex for an explanation. I also was transferred to offshore customer service, but only after being forced to navigate a bunch of irrelevant menus. That person transferred me to what sounded like another non-US “fraud expert” who couldn’t answer ANY questions about either the process (if any) used to verify those charges in the first place or even what other details (if any) had been provided to authenticate the charges. They just kept saying I’d need to get those from the merchant. I had those from the merchant, the question was why did Amex accept those charges when the merchant didn’t have correct authentication details. “I’m sorry sir, I’m not able to answer how they got your number”. That’s not my questiion! The one thing she let slip was something again about these were set up as recurring charges (the implication being those get handled with an eye towards always wanting them to go through). What I’ve concluded is that anyone who wants to set up a recurring service charge can simply guess at Amex numbers and provide bogus authentication details until they get a correct number. As crazy as that sounds, this does indeed seem to be the case which makes ALL Amex accounts vulnerable to this type of fraud no matter what the consumer is doing. I only spotted it because I hardly use the card and the services billed (aside from Sirius) were not things I’d ever use. As long as it’s a recurring transaction, it doesn’t seem to get authenticated at all! I asked if that was the case and she simply said she couldn’t answer my question. Unbelievable. I am shocked that such a glaring hole isn’t better known, but this blog is the only one that even touched on it on the first page of google results. It ought to be on the front page of every consumer magazine. I’m not leaving myself as the ONLY person doing basic security on charges to my account. I’m cancelling my Amex as soon as this round of billing shakes out.
Completely absurd. I’m sorry you had to deal with that. I’m still shocked at how vulnerable cardholders are.
I had the exact same problems. I knew about the recurring charges issue, cancelled my cards, and told them explicitly to block any transactions to any old card numbers. The charges still continued. I jump around and scream and yell at them on the phone after my 4th card cancellation, over $15k in recurring charges for our business card that still continue. They’re response is to contact the vendor and tell them to stop charging me. I even tried that but since the account wasn’t in my name but yet the credit card is, they can’t stop the charges until they speak to the individual who set it up. So you’re left with finding the thief who stole your info, asking them to see if they wouldn’t mind contacting the vendor in which they used your info and change the credit card to a different stolen card that isn’t in your name……Am I the only one that sees a problem with this solution? Why is it not that simple, cancel the card and the charges are declined to the old cards number, end of story. We’re not talking rocket science. If it’s a valid recurring charge, I can set it up manually on my own. I don’t need Amex trying to “accommodate” me by making it more convenient to allow recurring charges. I’m so fed up with Amex, I’ve been dealing with this for over a year and a half. I’m done with them. On to find another provider, I hate American Express! they used to be a great credit card provider but not anymore.
OmG. Thaks for this post. I know now why we are our 4thh replacement card,