1

For the second time in 8 weeks, one of my American Express (AMEX) card numbers was stolen. I do use the card online, but only at reputable (and SSL/TLS enabled sites). I use it in the real world, too, although nowhere shady. While AMEX's fraud prevention is good and they detected the attempted fraudulent usage, it's quite a hassle when they have to issue a new card. I've got several things set up to auto-pay, so I have remember all of them, log into their sites, and update my payment info.

I know that chip-and-pin cards are finally coming to the US in the next year or two. But i the meantime, what can I do to protect my credit card number better while still being able to use it? For online transactions, I wish I could set up one-time numbers, but AMEX no longer offers that service. Anything else I can do?

Improve this question
1
  • 1
    "nowhere shady"-Thats what everybody thinks!
    – Ebenezar John Paul
    Jul 24, 2014 at 9:27

2 Answers 2

Reset to default
1

The first thing I would do is a full audit of any device you enter your card number into. Obviously you can't audit the POS machines at the stores you use, but if it was a store issue, they would have gotten a notice by now. So the problem is probably in the computer(s) you use for online transactions. I'd go to any machine you've typed your number into and run a full virus/malware scan on it. Being compromised by 2 separate sources in such a short time isn't entirely impossible, but still unlikely.

I wish I could provide more insight to a solution to prevent future compromises but I'm not privy to any technology that'll help here. I realize I didn't really answer your question, but I still think my suggestion is very much worth looking into given the lack of time between compromises. It would certainly be a top priority of mine if I was in this situation.

Improve this answer
2
  • (I'm the OP) Yeah, auditing the POS terminals would probably be a bit tricky! I know the coincidence of two breaches so close together seems to imply a compromise of my system. But here's why I don't think that happened: First, I'm on a Mac. Yeah, I know they can get infected, too, but it's less likely due to the OS's tighter security model. Second, I'm very security conscious. I don't click links in emails, even from people I know, I don't visit questionable sites, and I don't fall for phishing schemes. I think the number got out some other way.
    – user249493
    Jul 22, 2014 at 23:53
  • Oh, and get this - my new AMEX arrived today and it HAS A CHIP! I know that won't do much for me in the US but I'm happy that AMEX is starting to roll them out. But there's something in the letter that's odd: "The embedded microchip makes your card extremely difficult to counterfeit or copy if it's lost or stolen." Uh, sure, OK. But if I lose my card, and someone finds it, they don't really need to copy it do they? Not sure how the chip really helps in that situation.
    – user249493
    Jul 22, 2014 at 23:54
1

Since I am a new user and cannot leave a comment, I'll expand on what JekwA said in his previous answer.

It's highly unlikely that the issue lies with any PoS system, either online or offline--rather--spyware on one of your devices would be to blame.

If I were you I'd resign myself to only using a single device for online transactions, and at all costs avoid doing so on a smart phone. If you have a primary computer I would do a fresh install with a new operating system, install the anti-malware software of your choice (mine would be Malwarebytes), and install a key scrambler. Most likely you've been infected with a keylogger, or a Remote Administration Tool (RAT) that's coupled with a key logger (really, they all are).

That's my two cents... and of course, exercise general caution and common sense when on the internet. Not to sound cliche, but a chain is only as strong as it's weakest link and more often than not that's the user.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .