uclacolumbiaunc

I don't know how American Express let this happen, but someone who got in possession of my newly approved Amex card and made an unauthorized charge without activating it. Since I have not received the card, it must be usps delivery mis-delivered the card to someone else ( and usps mis-delivery happens quite often) ..

But how can this happen for a major credit card company? i mean, the purpose of card activation is to ensure that the card holder receives the card before it can be used to make purchase, right?

This seems like a major security loophole on American express's part. And this is flat out unacceptable. Someone in Amex security team should be fired over this.

Frindle

This isn't just amex, and isn't uncommon at all. Most cards will work without calling in.

s0ssos

Yea. Have you seen people walking around using cards still with the "activate me" sticker on? If they can't be bothered to take it off, can they be bothered to activate it?

krazykanuck

When Chase shipped out the new Sapphire Reserve card there was no activation required sticker on them and they worked without being activated.

Somebody confirmed it with Chase and posted here http://www.flyertalk.com/forum/chase...l#post27118493

Happy

Yes. It was true.

For that very reason we SMed Chase to suspend our cards as they were delivered (dropped by our door) in the afternoon by UPS on the day we flew out in the morning, despite I asked UPS to deliver to our condo office which is in site.

Since we would not be back until 35 days later, I SMed Chase on both accounts requesting for suspension of the charge privilege until we return home. Chase obliged. Upon returning home we SMed Chase to remove the suspension - one account got the instruction to verify receipt while the other account did not get that instruction but said card was good to use anytime. To be on the safe side I went ahead to do the verification online on both cards, as we only had 40 days left to meet the $4K spend, so some big spends were needed very soon... I dont want to run into card decline scenario.

Steve M

How do you know it was not activated? You know that you didn't activate it, but that doesn't mean that someone else didn't.

How do you know this MUST be the situation? Perhaps someone with access to your mail got to it before you did (and such a person would likely know what they need to know to activate it). Or perhaps it got stolen from the mail stream.

The reason I say this is that something similar happened recently to someone I know. They had several thousand dollars of fraud charges appear on their Amex, all "card not present" transactions. By the time they got their statement and reported it, there were even more charges, but this time, they included a $1000 gift card purchase at a local Office Depot that had been done in-store using an EMV chip card terminal. So, no chance of cloned card, and the card was still in their possession. After some head-scratching, they confronted and got a confession from a relative that was a frequent house guest: they had removed the card, used it at Office Depot, and then put it back before it was noticed missing. If not for the EMV chip, the whole thing would likely have been attributed to a cloned card, and nobody would have been the wiser.

My point is, although it may end up being the case in the end, don't automatically assume that Amex and/or the post office is at fault here. There are lots of possible explanations.

uclacolumbiaunc

Amex agent told me the card had not been activated when I inquired about the unauthorized charge.

We checked our mail everyday, so we know we haven't received the card. If it's a mail theft, they can't be that lucky to know which envelope has the card and which day the card will be delivered... in the mean time, I have seen some mails that were meant for another address put in my mailbox by usps mailman.

strickerj

I'd say mail theft isn't that farfetched - it's easy to tell if an envelope has a card in it (just feel for the hard spot), and it's pretty easy to spot AmEx's return address in Omaha, which is where all of mine have come from. Misdelivery is certainly possible too. The big concern though is that the card can be used prior to activation - if that's the industry standard, then what's the point of the activation process?

uclacolumbiaunc

That's exactly why any card holders should be furious. The purpose of making card holders to activate a new card is to make sure that the new card is received by the real card holder, not some other random person.

If any new credit card can be used before the real card holder activates the card, what's the point of activation?

I would be shocked that's this is an industry standard... makes no sense.

uclacolumbiaunc

i just received the replacement card with new account number (new account number because of the unauthorized charge).

I tried using the replacement card to pay a bill online without activating it, and it turned out that the card is accepted without activation.

Honestly, this is a huge security issue, and i am not happy about this. Why bother making the real card holders activate a new card if anyone can use it without it being activated?

strickerj

Wow, that's ridiculous. I wonder if it's just AmEx or all of them?

tmiw

It actually makes sense that the card would still work for online transactions if it needs to be replaced. Visa and MC (not sure about AmEx) have a service that merchants can opt into that allows them to update customers' card data if cards need to be replaced for whatever reason; it's possible for a card to update on the merchant's systems and for them to attempt an authorization before receiving your new card. A decline due to that would likely cause problems with the merchant in question.

Also, fraud due to lost/misdirected mail is probably not large enough for issuers to be overly concerned with. That sort of cost/benefit analysis is why the US is getting chip and signature too.

eajusa

This is all news to me. I always assumed that unless you activate your new cards, they can't be used. Another reason not to make assumptions.

trikotret

A year ago I received an email from BofA saying that they sent out my renewal cards in the mail. A week later I got a call for fraud alert on cards and to confirm charges. I never received the cards and there were fraud charges on it. BofA cancelled the cards and sent me new ones. I think the USPS driver delivered my mail to someone else since I still do receive my neighbors mail. Sigh

antonius66

Had a citi card stolen from my porch and used for two weeks. I called citi and asked where my card was at the beginning of the two weeks and they told me it was still enroute, even though charges were already being made. Finally after calling again later did they tell me it was being used. I presume they did not need to activate it since they just took it from my porch and started using it.