Finance

Updated every Monday!   Subscribe to free weekly newsletter.

Security Flaw Found in Some Credit Cards

Consumer advocates have always advised the public to cut expired credit cards in half so they could not be used for fraudulent purposes by a garbage-picking crook. Following that conventional wisdom, however, is no safeguard that your full credit card number will not be stolen and used.

Here is the left half of an expired American Express card:

amexfrontm

With only half the number showing, even an enterprising crook could not use it to make a purchase. However, that is only one side of the story, so to speak. Turn over that half of the card:

*MOUSE PRINT:

amexbackm

The back side of the card reveals a small engraved number that represents the second half of the card number. (The leading “7” duplicates the last number visible on the front of the card.) And, note to crooks, the number on the reverse side has been altered so as not to jeopardize the real credit card number.

With the full credit card number visible, as well as the cardholder’s name, a clever crook could surmise the expiration date from the portion showing, and could potentially use the card to make online purchases. (Amex’s four digit security code, however, is not visible, and should a retail website ask for that information, this card would be rejected.)

When asked to comment on this security issue, and in particular why they issue cards with such an obvious security flaw and whether they were going to change the card’s design, a spokesperson for American Express responded in relevant part:

“I’m following up to let you know that we take the security of our cardmembers’ information, as well as fraud prevention, very seriously and have a number of sophisticated monitoring systems and controls in place to detect fraudulent card activity. We are constantly evolving these techniques to adapt to the changing activities of fraudsters.

We have learned that the best way to approach fraud prevention is from a holistic perspective. This means preventing fraud both on the consumer and merchant side of the transaction, looking at physical features of the Card as well as security information only the true Cardmember would know about the account. I cannot discuss specifics on this since the techniques would no longer be effective if we made them public.

One suggestion is for cardmembers to protect their personal and account information by shredding documents or cards before discarding them.” –Manager, Public Affairs & Communications | Risk, Information Management & Banking Group

Lest you think this is only an American Express issue, it is not. Below is the left half a Washington Mutual Visa card, front and back. The full credit card number is visible when putting the numbers found on the front and back of just that half together, as is the customer’s name and the security code. The expiration date can be discerned with a little guessing.

*MOUSE PRINT:

wamufandbm

A spokesperson for Chase, which took over Washington Mutual said:

“Chase only prints the last four digits of the customer account number on the back of the plastic. So, as WaMu accounts convert to Chase, the plastics will follow this specification.”

This is not a new problem.  It does not affect all card issuers by any means, and not all cards of the above issuers are affected.  The practice of printing the full account number on the reverse side of credit cards has been going on for a long time, as this was a problem first noticed with some MasterCards about 15 years ago.

Does your card have all 15 or 16 digits of credit card number printed on the back?

The lesson here is to not merely cut your old, expired cards in half when disposing of them, but to shred them.  If you don’t have a shredder, just cut the card in a number of small pieces, and throw them away in separate garbage bags.

Updated every Monday!   Subscribe to free weekly newsletter.

Cell Hell: AMEX Can Text Spam U Now :(

In MrConsumer’s American Express Optima bill for February, buried on page seven of a 10 page statement, was a “Notice of Changes to Your Account“. The changes were precipitated by “the challenging environment and the increasing costs of doing business”, the company said. Whenever a credit card company uses the word “changes”, it is a not good thing for customers. It usually means higher prices or lowered benefits.

Typical of most credit card issuers, they give you the new language, but generally don’t explain how the terms are different from before. So, unless you have the cardholder agreement that you received when your card was first issued, you may have no idea how exactly you are being screwed affected.

Besides presumably cutting back on their luggage and travel insurance benefits and raising finance charges for some cardholders, the notice contained an interesting section about telephone communications which is replacing the old one. To see just how it changed, I tried to find my original cardmember agreement, but was unable to. I checked AMEX’s website, and it was not there either. I called an AMEX representative and asked for a copy to be emailed, but alas, they can only do snail mail which will take seven to 10 business days. I also asked him to read a certain portion of it to me. He could not. They don’t even give their own representatives access to the contract that governs the card.

The change I was trying to find out about concerned a deletion of the old “Telephone Communications” section of the agreement, which presumably only said that you agree that they can record telephone conversations you have with them. Here is the substitute language:

*MOUSE PRINT:

“You agree that from time to time we may monitor and/or record telephone calls between you (or Additional Cardmembers on your Account) and us to assure the quality of our customer service or as required by applicable law. You authorize us to call or send a text message to you at any number you give us or from which you call us, including mobile phones. You authorize us to make such calls using automatic telephone dialing systems for any lawful purpose, including but not limited to: suspected fraud or identity theft; account transactions or servicing; offers of American Express products and services; and collecting on your account. You authorize us to place prerecorded calls in connection with the status of your account, or security and identity theft matters. You agree to pay any fees or charges you incur for incoming calls or text messages from us without reimbursement.”

Translation: If you ever gave AMEX your cellphone number or called them from it, you are permitting them to call you or text you on your cellphone, with among other things, advertising messages.  And you have to pay the cellphone charges that those calls and texts may incur.

By notifying you of the changed language and coupling that with your pre-agreement to allow AMEX to change their contract with you at anytime, AMEX could easily assert that any laws that may require you to give permission (“express consent”) to receive unsolicited promotional calls on your cellphone have been complied with. One would hope that a court would never let your silence constitute consent in the situation described. [ See basic rules about calling and texting to cellphones. ]

Now back to that conversation with AMEX’s customer service representative.  At the end of the call (in which I had never mentioned the specific subject matter in the agreement that I was interested in), he asked if he could update my account with … my cell number!  “Like hell,” I said.  “I just read the new rules that by giving you that number you can spam me and run up my cell bill.”

Update: American Express has responded to this issue:

We want to point out that Cardmembers do have some choices about receiving communication from American Express:

If a Cardmember doesn’t want to receive marketing offers, including offers via land or cell phones, they can select not to receive them by logging onto americanexpress.com/communications and we won’t contact them with any offers. Of course, we will contact Cardmembers for service related issues, for example if we detect fraud.

We don’t send marketing or promotional offers via text message unless a Cardmember enrolls to receive offers. While we may text a Cardmember for servicing related issues, within the text message Cardmembers are given the option to unsubscribe. — Vice President, Public Affairs

Updated every Monday!   Subscribe to free weekly newsletter.

Newpro Windows’ “Save 40% on Heating Costs” Guarantee

NewproNewpro is a brand of replacement windows that relies on salespeople coming to the house and demonstrating the product.  There are many stories online about aggressive sales pitches and outrageous initial price quotes.  One person was quoted $17,000 for 12 windows, another was told the price was $29,000 for 17 windows.  Borrowing from the timeshare salesperson’s book of tricks, the window pitchman typically checks with his boss, and gets permission to lower the price several thousand dollars.  The price still remains quite high, according to reports.

But that is not what this week’s Mouse Print* is about.  It is about the 40% fuel savings guarantee that Newpro advertises on TV and on the Internet.

On their website, Newpro elaborates on their promise that you will “Save 40% on your Home Heating Costs — Guaranteed!*”

Newpro

So far, so good, (except for having to replace all the windows in your house) until you follow the asterisk to the footnote:

*MOUSE PRINT:

**Restrictions apply. Fuel Savings Guarantee applies to homes where all windows are replaced with Newpro 2000 Windows. $500 limit applies. See Newpro Associate for details.

A $500 maximum?  If the windows did not reduce your fuel costs at all, in order to earn the maximum refund, your heating costs could be no higher than $1250 a year. ($1250 x 40% = $500).  For most homes, you probably pay much more than that annually for heat. Another example:  if your fuel costs were $3000 last winter, and you only experienced a 20% reduction this coming season, you would only qualify for $500 of the $600 you were owed.

While the 40% fuel savings claim is a great marketing tool, by limiting the refund to $500 and only making it apply for the first year, your new Newpro windows may not ultimately save you as much money over their life as you might expect. 

The even deeper details  say they do not calculate your refund based on the costs of heating from last year to this, but rather on your consumption (with oil falling in price, this is a good thing). Additionally, only their high-end windows qualify. And, if it is a really cold winter this year (“abnormal weather conditions”), the claim will be reduced.

So if you plan to make a $10,000, $20,000 or $30,000 purchase of new windows, keep in mind that a possible refund of $500 is miniscule in comparison, for what many say are grossly overpriced windows.