American Express fails miserably at basic security
This sounds scarier than it really is. Why? Because credit card companies focus on identifying fraudulent transactions rather than verifying your id.From Bruce Scheier's blog[1]:"But once you understand that the problem is fraudulent transactions, you quickly realize that authenticating the transaction, not the person, is the way to proceed."Again, think about credit cards. Store clerks barely verify signatures when people use cards. People can use credit cards to buy things by mail, phone or Internet, where no one verifies the signature or even that you have possession of the card."Even worse, no credit card company mandates secure storage requirements for credit cards. They don't demand that cardholders secure their wallets in any particular way. Credit card companies simply don't worry about verifying the cardholder or putting requirements on what he does. They concentrate on verifying the transaction."[1]:http://www.schneier.com/essay-153.html