Originally Posted by
zer0k1
... all publicly accessible info for whois lookups etc. No "personal info" per se
Business RSVP codes have been easier to transfer than personal codes, perhaps because American Express has less confidence in the quality of their data. Nonetheless, American Express could compare the original information for an RSVP invitation to the information of the person who used it, and if they see that a single individual used RSVP codes intended for several different people it won't take much imagination for them to figure out what has occurred.
Large enterprises move slowly (perhaps because someone's bonus depends on new accounts, and she doesn't initially care who applies), but when they tighten up it's a game of musical chairs and someone is left holding the worthless code.