Snick

Hello all,

I recently tried to transfer MR points to my Hilton account under the current promotion but I received a notice to call "888-654-0034", which is their identity security department. From my FT research this number was used during the Mercedez Benz Platinum card 100k gate and various identity verifications.

Was told that my recent transfer triggered a security alert. Really Amex? Transferring points to my Hilton account, under my name, same one that I have on my Surpass card triggers an alert? I had just linked the account if that matters.

Verified myself but they still wanted to call me on the phone number linked to my account. Unfortunately I’m out of the US right now without access to that phone number. Security agent was not believing that as they have a unique approach of considering everyone as thieves. Suggested him to provide the 3 number code on the back of the card, 3-way call with my bank, anything but he still wouldn’t budge. Eventually he proposed me to use NotaryCam to identify myself (video call with a notary). I’m waiting for an answer from Amex.

They could’ve just asked for a selfie holding ID in one hand, Amex card in the other and Hilton membership card glued to my forehead.

All this for some MR points transfer. Way to treat customers, as if a call to my phone number could really prevent theft.

mia

New link followed immediately by transfer probably trigger an algorithm.

Agents beliefs are irrelevant. It's a process, and not one in which the caller is able to propose a method of authentication. For example, you would have already provided both the three and four digit codes during the transfer process. Those only established that you have Snick's card, not that you are Snick. If someone else had transferred points from your MR account, would you expect American Express to accept responsibility?

drew in the air

This and this
New link with immediate transfer and likely from an unknown foreign IP...

safigan

+1. Entirely reasonable to check out someone linking an account from a foreign IP who then calls from a phone number not listed on the account who tells the agent he doesn't have access to the phone number on the account. Three strikes against you before you really even get started.

And a call to your phone number really can prevent theft. It's called two-factor authentication, and it works.

Snick

I do understand why these factors might have cause a security alert to my account. However, had it been a real identity theft, the thief could've spent "real" money not just transfer MR points.

To clarify, I did identify myself to the agent using the 4 number security code I set up with Amex (how can a thief possibly get it?) and and I tried offering them the 3 digit code on the back of the card meaning I had the numbers and most likely the 4 digit code in the front of the card. Just blocking the MR account is not real protection against someone holding all this information.

The foreign IP has previously been used to realize a transfer to an already linked account without hassle and it matches the country code where spent was put on cards. Their spending algorithm is smart enough to track flight travel purchases and waive future flags while abroad. One would expect the MR account algorithm is on par. I guess it all depends on how sensitive the algorithm is to certain key factors and is certainly not flawless. Not complaining they didn't block my credit service but just saying...

Anyway, i've complied with their notary demand and am waiting for an answer.