Gratitude Monday: security

Huh. As I mentioned last week, I did not go out shopping on Black Friday. However, apparently my American Express card did.

I fired up the email account I use for subscriptions, web transactions and listservs on Friday to find two notifications from Amex of a questionable charge late Thursday. The emails looked legit, having both my actual name as on the account, and appropriate email address, but because I get faux-Amex phishing attempts about once every six weeks, I still didn’t click on the “this is indeed fraud” button, I called their customer service line.

In the process of being verified, I had to haul out my mobile phone, and found three texts and a voicemail from them about the fraud. (Which I’ll have to deal with, because I’ve told them that I very seldom actually have that phone on, so it’s not a good mechanism for communicating with me.) This is an indicator of how seriously on top of things they are.

(By contrast, NatWest Bank in the UK waited two weeks of processing totally out-of-character charges on my debit card before sending me a letter via snail mail to ask if these were, by any chance, legit. They were not happy about having to eat the fraudulent £750, but tough toenails.)

Anyhow, Sean with Amex fraud protection walked me through verifying actual purchases by me and pinpointing the attempted fraud. This followed what I’ve heard is the typical pattern: a $1 charge somewhere to see if the account is active, then a much larger one—in this case, $455.79 at Target online. Amex didn’t let that charge go through, and they made the six attempts to contact me about it.

He also confirmed that the card wasn’t lost or stolen, that I didn’t “lend” it to anyone else, and that no one could have observed the digits. I do practice good security—online buying on SSL sites only (I look), shredding account statements and the like. This was probably someone going through a likely set of account numbers and seeing what would go through (ergo the $1 trial charge; with a construction company…).

Sean took care of the $455.79 plus $1 and then told me he’d send me a new card. At first he said he’d send it via USPS, and it would arrive on the 29^th. That’s just crazy talk, and I told him it would not do. (Seriously, dude? Look at my usage pattern. That puppy gets used four-five days a week. And we’re talking Black Friday and Cyber Monday. What? Are? You? Thinking?) So he put a rush on it, with delivery for Saturday; I had a new, metal card by 0940.

(I really don’t understand that send-it-by-USPS gambit. It’s called snail mail for a reason. And the last time this kind of thing happened—about five years ago—the Amex reps didn’t even mention mail as an option. Overnight it was —as it should be.)

Now here’s the thing: this is not the first time Amex has acted with dispatch when an uncharacteristic purchase shows up on my account. They run an exceptionally tight ship, with algorithms that must be a sight to behold. I shall now have to remember some new digits (when making online or phone purchases, I don’t even have to have my card out; I know the full account number and four-digit security code by heart, which on occasion has been, ah, very helpful), and will have to swap out the card on record with Amazon, but that is a small price to pay for the absence of hassle and reasonable sense of security that Amex has my back.

Definitely something to be grateful for.