I woke up the other morning to find 3 text messages with one-time codes on my phone. They'd apparently tried to link the card to a PayPal account and signed up to Netflix.
All sorted with a call to Amex who, unlike BA, seem to have decent customer service.