Consumer complaint received 2026-06-01 00:00:00
Product: Credit card — General-purpose credit card or charge card
Issue: Other features, terms, or problems — Other problem
Company: AMERICAN EXPRESS COMPANY
State: TX

Complaint narrative:
I am filing this complaint regarding two unauthorized or unexplained security incidents on my American Express account, and Amex 's failure to communicate any findings or resolution after 20 days, in apparent violation of their investigative obligations under Regulation E ( Electronic Fund Transfer Act ). Incident 1 : Unauthorized Voice Payment, XX/XX/year> On XX/XX/year>, an unauthorized voice payment was made on my American Express account via Amex 's automated pay-by-phone system. The payment was for the minimum balance due. My account is set up for automatic full statement balance payment via ACH from my linked checking account, which processes automatically a few days after the statement date. I have not made a phone payment on any credit card in more than a decade and did not initiate this payment. I reported this unauthorized electronic fund transfer to American Express on XX/XX/year>. As of XX/XX/year>, 20 days later, I have received no findings, no explanation, and no communication regarding the outcome of that report. Incident XXXX : Unsolicited SMS Payment Link, XX/XX/year> at XXXX I received an SMS message from American Express 's verified number at XXXX on Saturday XX/XX/year> stating " Amex : Here is the link you requested to make a payment. '' I did not request any payment link. When I contacted Amex about this message, they confirmed they have no record of a payment link being generated or sent for any of my cards. The origin of this SMS remains unexplained. Following this call, Amex closed and reissued my card. I have received communication confirming the new card is being sent, but still no findings or update on the XX/XX/XXXX unauthorized voice payment. Security Vulnerability I Am Reporting I personally tested Amex 's pay-by-phone system after these incidents and documented the following authentication chain when calling from a phone number associated with the account : the system asks for the last 4 digits of the Social Security Number, then the last 5 digits of the Amex card number, then offers to process a payment using the linked checking account on file, including stating the bank name and last 4 digits of the checking account. This authentication chain is exploitable through the following means, all of which are readily accessible to bad actors : First, phone number spoofing technology is widely available and free, allowing anyone to spoof a call from a victim 's associated phone number, which grants access to the easier authentication path. Second, the last 4 digits of Social Security Numbers are widely available through numerous large-scale data breaches affecting data brokers, government agencies, and financial institutions, including breaches that affected individuals who never directly interacted with the breached entity. Third, American Express card numbers follow a known, structured format. The last XXXX digits of a card number are not random and can be derived or bypassed via automated brute-forcing or scripted enumeration against the IVR phone system. My affected card was newly issued in XX/XX/year>, making it highly unlikely to have appeared in a legacy data breach, which further supports the conclusion that the card number was obtained through automated brute-forcing or scripted enumeration rather than a breach. The result is that a bad actor with spoofing capability and access to commonly breached personal data can authenticate into Amex 's pay-by-phone system and initiate ACH payments from a victim 's linked checking account without the account holder 's knowledge or consent, and without triggering any out-of-band verification such as a one-time passcode or push notification. What I Am Requesting I am requesting that the CFPB compel American Express to provide the following : XXXX. A full explanation of how the XX/XX/year> voice payment was authenticated, including what verification the caller passed and whether phone number spoofing was considered as the entry point. XXXX. A formal response to the XX/XX/year> SMS payment link that Amex 's own representatives can not account for. XXXX. An explanation of what steps Amex is taking or will take to address the structural authentication vulnerability in their pay-by-phone system described above, given that knowledge-based verification relying on SSN digits and predictable card number formats is no longer a meaningful security barrier in the current data breach environment. 4. A statement confirming whether Amex 's automated pay-by-phone system utilizes telecom attestation data to verify the legitimacy of the incoming Caller ID before granting access to the reduced verification path. I have made multiple good faith attempts to resolve this directly with American Express and have received no substantive response after 20 days.

Company response to consumer: Closed with explanation