No idea. Said friend is absolutely hopping mad with Amex that they managed to do this - although I can't imagine Amex would be too pleased that because of poor security they have had to re-imburse £15k... edit: I see above that liability is passed to the retailer.