Comment by uptown | Hacker News Reader

Comment by uptown | Hacker News Reader

Here's something I learned from AMEX last week ... if one of your cards gets compromised and you cancel the card, AMEX will continue to allow charges to flow through that old "canceled" number to your newly issued number if those charges are coming from a "trusted recurring entity". I discovered that charges were continuing to flow through a number that I'd canceled due to it being compromised even though I thought it'd been nullified. AMEX explained that their policy is to allow these charges to continue, and it took a number of months before I caught the problem because the charge was coming from a business I continued to have business with. Apparently the person that stole my number had setup a recurring charge with this business as well. To their credit, AMEX removed all of these charges even though they spanned a number of months ... but it caught me completely by surprise that a number I though was canceled was still allowing charges to flow through it.

That's standard practice for all cards, it's not just AMEX (I believe the authority is based on the account rather than the card). In the UK, there's no easy way to cancel a recurring payment on a card other than contacting the entity taking the payments. If they refuse, you can complain to the card provider and they will eventually sort it out, but payments will still go through in the meantime.

Moral of the story: Don't let anyone have a recurring payment authorisation on your card.

You can always close the CC account completely. Not ideal but it will work hard and fast.

Even if you do, you're still liable for any charges which hit the account after it's been closed, at least according to every closed account letter I've received (in the UK, not sure what the process is in other countries). Plus you can't close an account until the balance is clear.

Wow, that's insane. So, I close the account, paid in full. And a 10 days latter I receive a charge of 100 dollars and I still owe it. Would not surprise me if true.

I have an AMEX card that expired in 2007 and it is still successfully charged by AWS each month. Apparently, it's a big pain to get customers to re-enter new payment details when cards expire, as a result I believe merchants are often allowed to charge to cards that have long since expired.

Just curious ... why don't you update it?

Because it works

I was once very close to a server (that was in active use) getting disconnected/wiped by a hosting provider because my CC expired, and their mail to inform me of that got lost.

Only figured that one when the site went offline, didn't come back, and I started bitching at their support.

So I have some sympathy for the CC company being lax with recurring charges on expired cards. Would be a nice service if they went ahead and called you up in such a situation.

One would think it would be common sense to double check recurring charges to a canceled card with the account holder. Then again, when have financial institutions ever followed common sense..

Not just AMEX. I had an account drained (and indeed sent quite negative) after I explicitly cancelled a Msstercard to stop two such entities who would not cancel my accounts from continuing to charge me for services I wasn't using.

This also happened to me. The problem was that the fraud was coming from one of their "Trusted Entities" (Best Buy). So on day 1 I had $500 worth of fraudulent charges, and on day 2 I had to call them back and let them know of more fraudulent charges.

Reply on news.ycombinator.com