The Credit Card Fraud That Would Not Die

Andrew Brandt is a senior associate editor for PC World. You can send him e-mail at privacywatch@pcworld.com.

Illustration by Tomer Hanuka

When Jonathan Kamens of Boston got a phone call from American Express about suspicious activity on his credit card, he immediately canceled the card and had the company issue him a new number. But as he learned weeks later, that wasn't enough to put an end to the fraudulent charges.

Kamens discovered that American Express--without telling him--had sent the replacement number directly to America Online. The person who had stolen Kamens's old Amex number had used it to open two AOL accounts with automatic billing, and as a result the thief got automatic use of Kamens's new card, too. Even after getting a new card, Kamens was still paying for the bogus accounts.

"I was dismayed to learn that they would give my [replacement] card number to a merchant after I'd reported [the original] stolen," Kamens said. "That seemed ludicrous to me."

AOL spokesperson Nicholas Graham says the company has put a block on the use of Kamens's American Express number so that it can't be used to create new accounts. AOL has also refunded the charges incurred by the fraudulent accounts, and shut them down.

According to American Express spokesperson Desiree C. Fish, the company has had "a program in place [for several years] where we do this with a few select merchants [including AOL] for recurring billing customers." The company declined to tell me the names of the other businesses involved in the program, or even to give the number of merchants included.

Don't count on American Express to tell you, either: It is the merchant's job to alert cardmembers that the merchant may receive updated information about the cardmember's account, Fish says. In AOL's case, the paragraph that informs customers is buried in the terms of service. Fish says that her company is looking at ways to "strengthen the... notification requirement."

In fact, the policy seems to be unknown even to some American Express employees. After he discovered that the thief's AOL accounts were on his new Amex bill, Kamens called American Express to complain. He says the person he talked to "categorically denied" that the card company ever provided merchants with updated numbers.

Think you can avoid this kind of problem by avoiding American Express? Think again. MasterCard and Visa's Account Updater program allows companies that you have recurring bills with to get your new credit card number if your old card expires or if you cancel it and obtain a new card. In all three cases, however, you can opt out of the programs by calling customer service.