Just had another fraudulent transaction on my BA Amex card (which Amex approved). Only had the replacement card a week. The fraudulent transaction was PayPal Uber and it didn’t come from my PayPal account.

Called amex fraud team and asked them if this was against the new card and they said actually it was against the old card (which I cancelled 10 days ago). They have now done a ‘hard stop’ on that old card and admitted that they had stopped it but it would still allow any recurring payments against the old card. So it seems on a cancelled Amex all any fraudster has to do is initiate a payment with a vendor you have pre-authorised in the past and they can carry on defrauding.