On XXXX XXXX, we received multiple e-mail alerts from XXXX XXXX concerning possible fraudulent transactions. According to these alerts, over a 5-minute period, XXXX ( XXXX ) suspicious charges were attempted. All were fraudulent, and XXXX subsequently removed them from the account. XXXX issued a new card, and we have seen no further fraudulent activity on these accounts. 
Concerned about losses and uncertain about how the XXXX card was compromised ; we checked the current transactions on our XXXX card on XXXX XXXX. We discovered XXXX ( XXXX ) fraudulent charges made on XXXX XXXX, and posted to the account on XXXX XXXX. We did NOT receive security alerts about these bogus charges, nor have we received alerts about an additional XXXX ( XXXX ) phony charges reportedly transacted on XXXX XXXX. As of XXXX XXXX, the fraudulent charges to our XXXX account totaled {$9100.00}. 
The XXXX ( XXXX ) fraudulent charges to our XXXX account have multiple 'red flag ' features. 
These characteristics were explained in phone calls to XXXX ( XXXX ) representatives in the Fraud Department at XXXX on XXXX XXXX, XXXX, XXXX, and XXXX. XXXX of the XXXX XXXX. personnel told us that they/AMEX could NOT close the account, and only on the XXXX would the representative agree to block further charges. As of XXXX XXXX, only {$8200.00} was reimbursed to the XXXX account. XXXX also issued a new card. 
The fraudulent transactions were all made by the same entity, identified in the XXXX monthly statement as : 'E-GOV MIN. OF XXXX & XXXX. ' ( Abbreviated after to XXXX ) This entity did NOT have address or phone ID on the statement like our legitimate credit contacts. 
The XXXX statement shows XXXX billed our account on XXXX XXXX XXXX for a total of XXXX XXXX that XXXX converted to a {$320.00} charge on our account. 
The main shock in this fraud was seeing charges made to a credit card that was " deactivated '' by XXXX on XXXX XXXX 2014. All our legitimate charges since XXXX 2014 were on a replacement XXXX card. 
Information below on XXXX ( XXXX ) of the XXXX charges is derived from web access to our account and phone conversations with XXXX XXXX XXXX. employees. The monthly statement will not be available until about XXXX XXXX. XXXX reportedly made XXXX ( XXXX ) charges to the 'deactivated ' card on XXXX XXXX -- XXXX ( XXXX ) were posted on XXXX XXXX and XXXX ( XXXX ) were posted on XXXX XXXX. 
XXXX ( XXXX ) charges were identical in the amount of {$1300.00}. 
XXXX Fraud Dept. employees reluctantly admitted that all questionable charges on XXXX XXXX were foreign currency transactions in " XXXX '' on the 'deactivated ' card. None of the XXXX staff would identify the foreign currency. The XXXX reps could not ( or would not ) explain how a canceled card was approved for these transactions even after our repeated phone-call warnings of scam. 
Our own research into this fraud suggests the following : A legitimate foreign government entity exists with similarities to XXXX. 
In the city of XXXX, capital of XXXX, a government ministry sells water and electricity. This ministry provides an e-link for bill payment. See XXXX NOTE : We have not visited XXXX, knowingly purchased their goods or services, nor do we own property there. 
Using on-line currency converters, we found close correlation between the charges in BHD and conversion of XXXX XXXX into US dollars for the charges on XXXX XXXX. We do not know whether the XXXX card fraud and the XXXX card fraud are related, but the timing implies more than coincidence. Also, we are troubled about the apparent XXXX link to the XXXX fraud.