There is really no acceptable apology for this sort of scenario: Suspected fraud should trigger a call by the bank to the card holder, situation should be cleared up and next steps taken as appropriate. What portion of this mess should be attributed to BA and what portion goes to AMEX probably only the two companies can sort out between them, but one would hope they do so before it affects the next client.