What Can I Do While I'm Waiting for "Chip and Pin" Credit Cards?

Question

For the second time in 8 weeks, one of my American Express (AMEX) card numbers was stolen. I do use the card online, but only at reputable (and SSL/TLS enabled sites). I use it in the real world, too, although nowhere shady. While AMEX's fraud prevention is good and they detected the attempted fraudulent usage, it's quite a hassle when they have to issue a new card. I've got several things set up to auto-pay, so I have remember all of them, log into their sites, and update my payment info.

I know that chip-and-pin cards are finally coming to the US in the next year or two. But i the meantime, what can I do to protect my credit card number better while still being able to use it? For online transactions, I wish I could set up one-time numbers, but AMEX no longer offers that service. Anything else I can do?

Answer 1

The first thing I would do is a full audit of any device you enter your card number into. Obviously you can't audit the POS machines at the stores you use, but if it was a store issue, they would have gotten a notice by now. So the problem is probably in the computer(s) you use for online transactions. I'd go to any machine you've typed your number into and run a full virus/malware scan on it. Being compromised by 2 separate sources in such a short time isn't entirely impossible, but still unlikely.

I wish I could provide more insight to a solution to prevent future compromises but I'm not privy to any technology that'll help here. I realize I didn't really answer your question, but I still think my suggestion is very much worth looking into given the lack of time between compromises. It would certainly be a top priority of mine if I was in this situation.

Answer 2

Since I am a new user and cannot leave a comment, I'll expand on what JekwA said in his previous answer.

It's highly unlikely that the issue lies with any PoS system, either online or offline--rather--spyware on one of your devices would be to blame.

If I were you I'd resign myself to only using a single device for online transactions, and at all costs avoid doing so on a smart phone. If you have a primary computer I would do a fresh install with a new operating system, install the anti-malware software of your choice (mine would be Malwarebytes), and install a key scrambler. Most likely you've been infected with a keylogger, or a Remote Administration Tool (RAT) that's coupled with a key logger (really, they all are).

That's my two cents... and of course, exercise general caution and common sense when on the internet. Not to sound cliche, but a chain is only as strong as it's weakest link and more often than not that's the user.