1

For the second time in 8 weeks, one of my American Express (AMEX) card numbers was stolen. I do use the card online, but only at reputable (and SSL/TLS enabled sites). I use it in the real world, too, although nowhere shady. While AMEX's fraud prevention is good and they detected the attempted fraudulent usage, it's quite a hassle when they have to issue a new card. I've got several things set up to auto-pay, so I have remember all of them, log into their sites, and update my payment info.

I know that chip-and-pin cards are finally coming to the US in the next year or two. But i the meantime, what can I do to protect my credit card number better while still being able to use it? For online transactions, I wish I could set up one-time numbers, but AMEX no longer offers that service. Anything else I can do?

1
  • 1
    "nowhere shady"-Thats what everybody thinks! Jul 24, 2014 at 9:27

2 Answers 2

1

The first thing I would do is a full audit of any device you enter your card number into. Obviously you can't audit the POS machines at the stores you use, but if it was a store issue, they would have gotten a notice by now. So the problem is probably in the computer(s) you use for online transactions. I'd go to any machine you've typed your number into and run a full virus/malware scan on it. Being compromised by 2 separate sources in such a short time isn't entirely impossible, but still unlikely.

I wish I could provide more insight to a solution to prevent future compromises but I'm not privy to any technology that'll help here. I realize I didn't really answer your question, but I still think my suggestion is very much worth looking into given the lack of time between compromises. It would certainly be a top priority of mine if I was in this situation.

2
  • (I'm the OP) Yeah, auditing the POS terminals would probably be a bit tricky! I know the coincidence of two breaches so close together seems to imply a compromise of my system. But here's why I don't think that happened: First, I'm on a Mac. Yeah, I know they can get infected, too, but it's less likely due to the OS's tighter security model. Second, I'm very security conscious. I don't click links in emails, even from people I know, I don't visit questionable sites, and I don't fall for phishing schemes. I think the number got out some other way.
    – user249493
    Jul 22, 2014 at 23:53
  • Oh, and get this - my new AMEX arrived today and it HAS A CHIP! I know that won't do much for me in the US but I'm happy that AMEX is starting to roll them out. But there's something in the letter that's odd: "The embedded microchip makes your card extremely difficult to counterfeit or copy if it's lost or stolen." Uh, sure, OK. But if I lose my card, and someone finds it, they don't really need to copy it do they? Not sure how the chip really helps in that situation.
    – user249493
    Jul 22, 2014 at 23:54
1

Since I am a new user and cannot leave a comment, I'll expand on what JekwA said in his previous answer.

It's highly unlikely that the issue lies with any PoS system, either online or offline--rather--spyware on one of your devices would be to blame.

If I were you I'd resign myself to only using a single device for online transactions, and at all costs avoid doing so on a smart phone. If you have a primary computer I would do a fresh install with a new operating system, install the anti-malware software of your choice (mine would be Malwarebytes), and install a key scrambler. Most likely you've been infected with a keylogger, or a Remote Administration Tool (RAT) that's coupled with a key logger (really, they all are).

That's my two cents... and of course, exercise general caution and common sense when on the internet. Not to sound cliche, but a chain is only as strong as it's weakest link and more often than not that's the user.

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .