Go Back  FlyerTalk Forums > Miles&Points > Credit, Debit and Prepaid Card Programs > American Express | Membership Rewards
Reload this Page >

Beware: someone can use your newly-approved Amex card without activating it.

Beware: someone can use your newly-approved Amex card without activating it.

Old Dec 28, 2016, 5:17 am
  #1  
Original Poster
 
Join Date: Apr 2014
Posts: 1,778
Beware: someone can use your newly-approved Amex card without activating it.

I don't know how American Express let this happen, but someone who got in possession of my newly approved Amex card and made an unauthorized charge without activating it. Since I have not received the card, it must be usps delivery mis-delivered the card to someone else ( and usps mis-delivery happens quite often) ..

But how can this happen for a major credit card company? i mean, the purpose of card activation is to ensure that the card holder receives the card before it can be used to make purchase, right?

This seems like a major security loophole on American express's part. And this is flat out unacceptable. Someone in Amex security team should be fired over this.
uclacolumbiaunc is offline  
Old Dec 28, 2016, 5:24 am
  #2  
 
Join Date: May 2014
Posts: 378
This isn't just amex, and isn't uncommon at all. Most cards will work without calling in.
lowfareair likes this.
Frindle is offline  
Old Dec 28, 2016, 6:42 am
  #3  
 
Join Date: Sep 2008
Posts: 7,876
Originally Posted by Frindle
This isn't just amex, and isn't uncommon at all. Most cards will work without calling in.
Yea. Have you seen people walking around using cards still with the "activate me" sticker on? If they can't be bothered to take it off, can they be bothered to activate it?
s0ssos is offline  
Old Dec 28, 2016, 7:10 am
  #4  
FlyerTalk Evangelist
Hilton Contributor Badge
 
Join Date: Jul 2008
Location: IAH
Programs: DL DM, Hyatt Ist-iest, Stariott Platinum, Hilton Diamond
Posts: 12,837
When Chase shipped out the new Sapphire Reserve card there was no activation required sticker on them and they worked without being activated.

Somebody confirmed it with Chase and posted here http://www.flyertalk.com/forum/chase...l#post27118493
krazykanuck is online now  
Old Dec 28, 2016, 6:23 pm
  #5  
FlyerTalk Evangelist
 
Join Date: Jul 2003
Location: Florida
Posts: 29,807
Originally Posted by krazykanuck
When Chase shipped out the new Sapphire Reserve card there was no activation required sticker on them and they worked without being activated.

Somebody confirmed it with Chase and posted here http://www.flyertalk.com/forum/chase...l#post27118493
Yes. It was true.

For that very reason we SMed Chase to suspend our cards as they were delivered (dropped by our door) in the afternoon by UPS on the day we flew out in the morning, despite I asked UPS to deliver to our condo office which is in site.

Since we would not be back until 35 days later, I SMed Chase on both accounts requesting for suspension of the charge privilege until we return home. Chase obliged. Upon returning home we SMed Chase to remove the suspension - one account got the instruction to verify receipt while the other account did not get that instruction but said card was good to use anytime. To be on the safe side I went ahead to do the verification online on both cards, as we only had 40 days left to meet the $4K spend, so some big spends were needed very soon... I dont want to run into card decline scenario.
Happy is offline  
Old Dec 28, 2016, 7:49 pm
  #6  
 
Join Date: May 2000
Location: Houston, TX, USA
Programs: UA Platinum, AA Lifetime Platinum, DL Platinum, Honors Diamond, Bonvoy Ambassador, Hertz Platinum
Posts: 7,979
Originally Posted by uclacolumbiaunc
I don't know how American Express let this happen, but someone who got in possession of my newly approved Amex card and made an unauthorized charge without activating it.
How do you know it was not activated? You know that you didn't activate it, but that doesn't mean that someone else didn't.

it must be usps delivery mis-delivered the card to someone else
How do you know this MUST be the situation? Perhaps someone with access to your mail got to it before you did (and such a person would likely know what they need to know to activate it). Or perhaps it got stolen from the mail stream.

The reason I say this is that something similar happened recently to someone I know. They had several thousand dollars of fraud charges appear on their Amex, all "card not present" transactions. By the time they got their statement and reported it, there were even more charges, but this time, they included a $1000 gift card purchase at a local Office Depot that had been done in-store using an EMV chip card terminal. So, no chance of cloned card, and the card was still in their possession. After some head-scratching, they confronted and got a confession from a relative that was a frequent house guest: they had removed the card, used it at Office Depot, and then put it back before it was noticed missing. If not for the EMV chip, the whole thing would likely have been attributed to a cloned card, and nobody would have been the wiser.

My point is, although it may end up being the case in the end, don't automatically assume that Amex and/or the post office is at fault here. There are lots of possible explanations.
Steve M is offline  
Old Dec 29, 2016, 2:02 am
  #7  
Original Poster
 
Join Date: Apr 2014
Posts: 1,778
Originally Posted by Steve M
How do you know it was not activated? You know that you didn't activate it, but that doesn't mean that someone else didn't.



How do you know this MUST be the situation? Perhaps someone with access to your mail got to it before you did (and such a person would likely know what they need to know to activate it). Or perhaps it got stolen from the mail stream.

The reason I say this is that something similar happened recently to someone I know. They had several thousand dollars of fraud charges appear on their Amex, all "card not present" transactions. By the time they got their statement and reported it, there were even more charges, but this time, they included a $1000 gift card purchase at a local Office Depot that had been done in-store using an EMV chip card terminal. So, no chance of cloned card, and the card was still in their possession. After some head-scratching, they confronted and got a confession from a relative that was a frequent house guest: they had removed the card, used it at Office Depot, and then put it back before it was noticed missing. If not for the EMV chip, the whole thing would likely have been attributed to a cloned card, and nobody would have been the wiser.

My point is, although it may end up being the case in the end, don't automatically assume that Amex and/or the post office is at fault here. There are lots of possible explanations.
Amex agent told me the card had not been activated when I inquired about the unauthorized charge.

We checked our mail everyday, so we know we haven't received the card. If it's a mail theft, they can't be that lucky to know which envelope has the card and which day the card will be delivered... in the mean time, I have seen some mails that were meant for another address put in my mailbox by usps mailman.
uclacolumbiaunc is offline  
Old Dec 29, 2016, 8:02 am
  #8  
 
Join Date: Jun 2015
Location: DTW
Programs: Alaska, Delta, Southwest
Posts: 1,664
Originally Posted by uclacolumbiaunc
Amex agent told me the card had not been activated when I inquired about the unauthorized charge.

We checked our mail everyday, so we know we haven't received the card. If it's a mail theft, they can't be that lucky to know which envelope has the card and which day the card will be delivered... in the mean time, I have seen some mails that were meant for another address put in my mailbox by usps mailman.
I'd say mail theft isn't that farfetched - it's easy to tell if an envelope has a card in it (just feel for the hard spot), and it's pretty easy to spot AmEx's return address in Omaha, which is where all of mine have come from. Misdelivery is certainly possible too. The big concern though is that the card can be used prior to activation - if that's the industry standard, then what's the point of the activation process?

Last edited by strickerj; Dec 29, 2016 at 8:03 am Reason: Typo
strickerj is offline  
Old Dec 29, 2016, 4:59 pm
  #9  
Original Poster
 
Join Date: Apr 2014
Posts: 1,778
Originally Posted by strickerj
I'd say mail theft isn't that farfetched - it's easy to tell if an envelope has a card in it (just feel for the hard spot), and it's pretty easy to spot AmEx's return address in Omaha, which is where all of mine have come from. Misdelivery is certainly possible too. The big concern though is that the card can be used prior to activation - if that's the industry standard, then what's the point of the activation process?
That's exactly why any card holders should be furious. The purpose of making card holders to activate a new card is to make sure that the new card is received by the real card holder, not some other random person.

If any new credit card can be used before the real card holder activates the card, what's the point of activation?

I would be shocked that's this is an industry standard... makes no sense.
uclacolumbiaunc is offline  
Old Dec 29, 2016, 5:11 pm
  #10  
Original Poster
 
Join Date: Apr 2014
Posts: 1,778
i just received the replacement card with new account number (new account number because of the unauthorized charge).

I tried using the replacement card to pay a bill online without activating it, and it turned out that the card is accepted without activation.

Honestly, this is a huge security issue, and i am not happy about this. Why bother making the real card holders activate a new card if anyone can use it without it being activated?
uclacolumbiaunc is offline  
Old Dec 30, 2016, 9:49 am
  #11  
 
Join Date: Jun 2015
Location: DTW
Programs: Alaska, Delta, Southwest
Posts: 1,664
Originally Posted by uclacolumbiaunc
i just received the replacement card with new account number (new account number because of the unauthorized charge).

I tried using the replacement card to pay a bill online without activating it, and it turned out that the card is accepted without activation.

Honestly, this is a huge security issue, and i am not happy about this. Why bother making the real card holders activate a new card if anyone can use it without it being activated?
Wow, that's ridiculous. I wonder if it's just AmEx or all of them?
strickerj is offline  
Old Dec 30, 2016, 11:23 am
  #12  
FlyerTalk Evangelist
 
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,517
It actually makes sense that the card would still work for online transactions if it needs to be replaced. Visa and MC (not sure about AmEx) have a service that merchants can opt into that allows them to update customers' card data if cards need to be replaced for whatever reason; it's possible for a card to update on the merchant's systems and for them to attempt an authorization before receiving your new card. A decline due to that would likely cause problems with the merchant in question.

Also, fraud due to lost/misdirected mail is probably not large enough for issuers to be overly concerned with. That sort of cost/benefit analysis is why the US is getting chip and signature too.
tmiw is online now  
Old Dec 30, 2016, 6:42 pm
  #13  
 
Join Date: Apr 2013
Location: Lehigh Valley, Pennsylvania
Programs: Milege+, SkyMiles, AAdvantage, HHonors Diamond, Marriott Gold
Posts: 1,686
This is all news to me. I always assumed that unless you activate your new cards, they can't be used. Another reason not to make assumptions.
eajusa is offline  
Old Dec 31, 2016, 9:03 am
  #14  
 
Join Date: Jun 2008
Location: BAY AREA
Posts: 1,128
A year ago I received an email from BofA saying that they sent out my renewal cards in the mail. A week later I got a call for fraud alert on cards and to confirm charges. I never received the cards and there were fraud charges on it. BofA cancelled the cards and sent me new ones. I think the USPS driver delivered my mail to someone else since I still do receive my neighbors mail. Sigh
trikotret is offline  
Old Jan 1, 2017, 2:13 pm
  #15  
 
Join Date: Jan 2008
Posts: 3,601
Had a citi card stolen from my porch and used for two weeks. I called citi and asked where my card was at the beginning of the two weeks and they told me it was still enroute, even though charges were already being made. Finally after calling again later did they tell me it was being used. I presume they did not need to activate it since they just took it from my porch and started using it.
antonius66 is online now  

Thread Tools
Search this Thread

Contact Us - Manage Preferences - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service -

This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.