Adventures in Credit Card Security
February 16, 2016
Got an email alert from American Express. Some fool had my card number and was trying to use it for a telephone purchase in Toronto. Of course, I was out of the country, so the algorithms didn’t line up when the merchant went for approval. The purchase was declined and the email instructed me to call and let them know if was legitimate or fraudulent.
“Fraudulent,” I told the nice young woman on the phone. And the process of cancelling the old card and sending me a new one began.
Easy-peesy, right? Not even close because I didn’t want them to send the card to my home. I wanted them to send it where I was.
“No problem,” said the nice young woman. “You just need to answer three security questions that will be randomly generated by Trans Union Canada.”
In case you haven’t heard of them, Trans Union is a credit reporting agency, like Equifax. They gather information about you and make it available to institutions looking to issue you credit. This includes your credit history as well as basic information such as your name, current address and phone number. They also keep historical information about past addresses going back more than 10 years.
None of this seemed problematic when the nice young woman said, “You need to get all three questions right, and you only get two chances.” Fire away, I told her.
Question One. Which of the following credit cards do you currently hold? A, B, C or none of the above. For me, the correct answer was C.
Question Two. In which of the following towns or cities have you lived in the past ten years? A, B, C or D. For me, the correct answer was D.
Question Three. Which of the following is a previous address. A, B, C or D. Again, for me, the correct answer was D.
But I failed the test. She generated three questions again. Two of the same ones came up. Again, I failed.
How was that possible? I know where I’ve lived, I know what credit cards I have. Yet, there it was on her screen. Failed.
Now I had to wait 48 hours before 3 more questions would be generated.
I tried speaking to supervisers, I tried to escalate the call because something was wrong, all to no avail. There is no way around the questions and no way to speed up the process.
So I waited 48 hours. Another nice young woman asked me three questions. Again, I failed.
Now I was pissed. “Trans Union must have some wrong information,” I told her.
Perhaps, she agreed. But I still had to wait another 48 hours to try again.
She gave me a phone number for Trans Union. I called and sure enough, they had all of my personal information wrong. Even my name was spelled incorrectly.
Turned out they had combined both of my daughters’ information with mine to come up with a person who didn’t actually exist but had my Social Insurance Number.
The woman from Trans Union agreed that I could never have passed the American Express test with real answers. And it would take 30 days for the report to be updated for their clients. Her advice to me? Answer the questions incorrectly. She even told me which answers to give for the questions.
I called Amex. The nice young man was very understanding but regardless of the Trans Union errors, I still had to wait 48 hours to try the test again. Unless I wanted to have the card sent to my home address instead. “I’m not there,” I told him.
“I know,” he said, and we went around and around that issue for a while until finally I said, “Fine, send it there.”
“Someone has to be there to sign for it,” he told me.
“Fine,” I said again, knowing I’d have to impose on the lovely woman looking after my cat and the next door neighbour and anyone else who might be willing to wait around for the courier to arrive.
Turned out that they didn’t send it by courier after all. They sent it by Express Post. The tracking information said it was successfully delivered, but not to my house.
So I called Amex again. Since more than 48 hours had passed, I said I wanted to try the 3 questions again so the card could be sent to the address where I was instead of my house.
This time, I answered the questions with the incorrect information supplied by Trans Union and I passed the test. My card was sent again. I was told it would come by the US Postal System. No need to wait in.
Of course, the card arrived by courier. The driver went to the wrong unit and knocked on my neighbour’s door instead of mine, but fortunately he was home and he signed for it.
Two weeks after the jerk in Toronto tried to buy plumbing parts with my old card, I finally had my new one.
The whole ordeal has left me shaking my head.
Security is only as good as the information behind it. Trans Union has a lot to answer for, and American Express needs to initiate a way for customers to get around their roadblocks, when the information they’re relying on is wrong. And you need to check with every credit reporting agency out there to make sure they have your correct information!