How to Spot American Express Phishing Scams in 5 Steps

Why American Express Phishing Scams Are Getting Harder to Spot

American Express phishing is one of the most active and convincing forms of financial fraud targeting cardholders and businesses today. If you’ve landed here because you received a suspicious email, text, or call claiming to be from Amex, here’s what you need to know right now:

Quick answer — how to spot an American Express phishing attempt:

1. Check the sender domain. Legitimate Amex emails come from domains like @americanexpress.com or @aexp.com — not @info.net or other lookalikes.
2. Never click links in unexpected emails. Go directly to americanexpress.com by typing it into your browser.
3. Hang up on suspicious calls. Amex will never call you to ask for your PIN, password, SafeKey code, or full card details.
4. Report it. Forward suspicious emails to spoof@americanexpress.com.
5. If you already clicked or entered details, call the number on the back of your card immediately.

These scams have become remarkably convincing. Attackers now run multi-step campaigns that mimic real Amex security alerts, complete with fake login pages, card verification prompts, and even fake MFA screens designed to steal your one-time codes in real time.

One widely analyzed campaign used the subject line “Resolve Unusual Activity on Your American Express Account Now” — urgent, official-looking, and easy to fall for. Another intercepted campaign walked victims through five separate fake pages, harvesting login credentials, card security codes, identity answers, SMS codes, and email one-time passwords one step at a time.

For IT leaders managing teams in regulated industries, the risk goes beyond personal accounts. When an employee falls for an Amex phishing email on a corporate device, the door to credential reuse and business email compromise opens fast.

This guide walks you through exactly how these attacks work and five clear steps to stop them.

The Anatomy of Modern Amex Phishing Campaigns

To beat a modern scammer, you have to think like one. Today’s cybercriminals are no longer sending broken-English emails asking for wire transfers. Instead, they run sleek, automated, multi-stage campaigns that exploit our cognitive biases—specifically trust, urgency, and fear.

The Mechanics of an American Express Phishing Campaign

Modern phishing campaigns targeting American Express cardholders are highly sophisticated operations. They rely on multi-step credential harvesting pipelines designed to bypass security measures like Multi-Factor Authentication (MFA) in real time.

When researchers are Analyzing an American Express Phishing Campaign , they often find complex, multi-page web applications hosted on compromised servers or dynamic cloud architectures. A classic campaign, such as the one detailed in American Express “Sign-In Alert” phishing email leads to fake multi‑step credential harvesting pages , works via a carefully orchestrated 5-stage flow:

1. The Initial Lure: The victim receives a spoofed email claiming there is an urgent security issue, a locked account, or a “Sign-In Alert.”
2. The Fake Login Portal: Clicking the link redirects the user to a pixel-perfect replica of the Amex login portal. The moment the user types their username and password, the credentials are sent directly to the attacker’s server.
3. Card and Identity Harvesting: Instead of logging the user in, the site displays a second page asking for the 3-digit or 4-digit Card Identification (CID) number, mother’s maiden name, and other personal verification details.
4. The MFA Intercept: The phishing site prompts the victim to enter their 6-digit SMS verification code or email One-Time Password (OTP). In the background, the attacker’s automated script attempts to log into the real Amex portal using the stolen credentials, triggering a real MFA code to the victim’s phone. When the victim enters that code on the fake site, the attacker intercepts it and logs in.
5. The Verification Buffer: The victim is shown a fake loading screen with a spinning wheel (e.g., “Verifying your details, please wait…”). This keeps the victim waiting while the attacker completes the unauthorized access, registers a digital wallet, or drains the account.

Smishing, Vishing, and Quishing Tactics

Phishing is no longer confined to your inbox. Attackers leverage multiple channels to catch cardholders off guard:

• Smishing (SMS Phishing): Scammers use text messages to deliver urgent alerts. Common lures include fake package delivery notifications (e.g., “USPS could not deliver your package, update payment info”) or unpaid highway toll alerts. These texts contain shortened URLs that lead straight to card-harvesting landing pages.
• Vishing (Voice Phishing): Fraudsters spoof caller ID displays to make it look like “American Express” is calling. They present a scenario—such as detecting a massive fraudulent charge—and walk the victim through “verifying their identity” by asking them to read back a SafeKey code or one-time password sent to their phone.
• Quishing (QR Code Phishing): As explained in What is Phishing? | How to Spot Email Scams | American Express IN , quishing involves embedding malicious QR codes in emails or physical letters. Because security filters find it difficult to scan QR codes for malicious payloads, these often slip past corporate email defenses.
• Digital Wallet Registration Fraud: This is the ultimate goal of many modern vishing and smishing campaigns. Scammers do not just want your card number; they want to link your Amex card to their Apple Pay or Google Pay wallet. To do this, they need the dynamic one-time code sent by Amex. They will call or text you, pretending to be fraud prevention specialists, and trick you into giving up that specific verification code.

5 Steps to Identify and Avoid Amex Phishing Attacks

Protecting your personal and corporate accounts requires a combination of technical awareness and healthy skepticism. Use these five practical steps to spot and stop american express phishing attacks before they do damage.

Step 1: Spotting American Express Phishing in Your Inbox

Phishing emails are designed to look identical to legitimate communications, but they always leave technical footprints.

First, ignore the “From” display name, which can be easily faked. Instead, look closely at the actual sending email address and domain. Legitimate American Express communications originate from a strict list of official domains, such as:

• @americanexpress.com
• @email.americanexpress.com
• @welcome.aexp.com
• @aexp.com

If the email address ends in @info.net, @amex-security-update.com, or any other variation, it is a scam.

However, as highlighted in Shame on American Express and evaluating a phishing email , even legitimate corporate alerts can sometimes look suspicious because of poor design or unlisted phone numbers. To be absolutely sure, technical users can inspect the raw email headers to check for SPF (Sender Policy Framework), DKIM, and DMARC passes. If the sending IP address does not match American Express’s authorized servers, delete the message immediately.

Other red flags include:

• Generic greetings (e.g., “Dear Customer” instead of your actual name).
• High-pressure language demanding immediate action to avoid account suspension.
• Unexpected attachments (Amex will rarely send unsolicited attachments).

Step 2: Inspect the URL and Watch for Redirection

Before clicking any link in an email, hover your mouse over the button or link to inspect the destination URL.

Attackers often use URL shorteners (like Twitter’s t.co or bit.ly) or complex tracking links to mask the final malicious destination from basic email scanners. If you click a link and see multiple rapid redirects in your browser’s address bar, close the tab immediately.

Ensure the landing page domain is exactly americanexpress.com (or the official localized version for your region). Look for subtle typosquatting, such as american-express-login.com or americannexpress.com. A secure connection padlock icon is necessary, but remember: modern scammers easily obtain SSL certificates for their fake domains, so a padlock icon alone does not guarantee safety.

Step 3: Know What Amex Will Never Ask You

One of your strongest defenses is knowing the absolute boundaries of what a legitimate financial institution will ask. According to Phishing Scam Awareness & Protection | American Express US , American Express will never contact you out of the blue to ask for:

• Your full account password or PIN.
• Your 3-digit or 4-digit CID security code.
• One-time verification codes, passcodes, or SafeKey codes.
• Your mother’s maiden name or full social security number.
• Immediate payment via unusual methods like gift cards, cryptocurrency, or wire transfers to “resolve a security hold.”

If a caller or an email insists that you must provide this information to keep your account open, you are dealing with a scammer.

Step 4: Use the STOP, CHECK, PROTECT Framework

When faced with an unexpected, high-pressure communication, don’t let panic dictate your actions. Apply the STOP, CHECK, PROTECT framework:

• STOP: Take a breath. Phishing attacks rely on emotional triggers—fear of a locked account or excitement over a reward. Pause before clicking or replying.
• CHECK: Verify the details. Does the email domain match? Is the phone number listed on the official Amex website?
• PROTECT: If something feels off, trust your instincts. Do not share any data.

To proactively reduce your risk, you can also use data removal services to erase your personal details from public data brokers. Scammers regularly buy this data to customize their phishing templates, making their emails look highly personalized and convincing.

Step 5: Leverage Official Verification Channels

If you ever receive an alert about “unusual activity” or an “account limitation,” the safest action is to bypass the communication entirely.

Do not use the links, buttons, or phone numbers provided in the message. Instead:

1. Turn over your physical American Express card and call the official customer service number printed on the back.
2. Open your web browser, type americanexpress.com directly into the address bar, and log in securely.
3. Open the official Amex mobile app on your smartphone to check for any legitimate alerts.

Additionally, we recommend setting up Voice ID verification within your Amex account profile. This adds an extra layer of biometric security when you call customer service, making it much harder for scammers to impersonate you over the phone.

How to Defend Against American Express Phishing

Maintaining digital resilience requires a proactive posture. Here is how to handle suspicious messages, respond to security incidents, and protect your organization from brand impersonation at scale.

Reporting Suspicious Activity to Amex

If you receive a phishing email or text message that impersonates American Express, do not just delete it. Reporting it helps take down the malicious infrastructure.

• Emails: Forward the suspicious email as an attachment to spoof@americanexpress.com.
• SMS/Smishing: Take a screenshot of the message and forward the details to Amex or your mobile carrier’s spam reporting number (usually 7726).
• Federal Reporting: You can also report financial scams directly to the Federal Trade Commission (FTC) at reportfraud.ftc.gov or log identity theft cases at identitytheft.gov.

Incident Response Steps for Compromised Accounts

If you believe you have accidentally entered your credentials or card details on a phishing site, act quickly:

1. Change Your Password: Immediately log into the official Amex portal and change your password. If you reuse this password elsewhere, update those accounts too.
2. Contact Amex Fraud Support: Call the number on the back of your card or 1-800-528-4800. Inform them that your card details or login credentials may have been compromised.
3. Freeze or Replace Your Card: Request a card replacement. Amex will issue a new card with a new number and CID.
4. Review Security Settings: Check your account’s contact details (both the Card Profile and the Authentication Management section) to ensure the attacker did not add their own phone number or email for MFA redirection.
5. Enable Push Notifications: Turn on real-time transaction alerts in the Amex App to monitor for unauthorized charges instantly. Refer to the Breach Response Guide 2026 for a structured approach to managing containment.

Mitigating Brand Impersonation and Credential Theft at Scale

For CISOs, IT directors, and technical leaders, consumer-focused security tips are only half the battle. When employees access personal financial accounts on corporate devices, a single credential-harvesting phishing email can lead to broader business email compromise (BEC). Attackers often exploit password reuse to move laterally from a compromised personal account into corporate networks.

To mitigate these risks, organizations should focus on building digital resilience across security, data, cloud, network, and infrastructure. Implementing a layered security strategy helps eliminate blind spots and tool sprawl, focusing on alignment over complexity to position security as a business enabler.

Deploying rapid breach detection capabilities and utilizing Managed Detection and Response (MDR) services can significantly reduce alert fatigue and identify compromised credentials before they are leveraged for lateral movement.

Taking a holistic, vendor-agnostic approach to security reduces the operational burden on internal teams, allowing organizations to maintain a secure digital perimeter. Learn more about proactive defense in The Complete Guide to Enterprise Breach Detection.

Frequently Asked Questions About Amex Scams

How can I verify if an email from Amex is legitimate?

A legitimate Amex email will always come from an official domain like @americanexpress.com or @email.americanexpress.com. It will typically address you by your actual name or show a portion of your card number. To be 100% sure, check the SPF and DMARC alignment in the email headers, or simply log into your account directly via the official app rather than clicking any links in the email.

What should I do if I entered my CID or SafeKey on a fake site?

If you entered your CID, password, or SafeKey code on a phishing site, call the number on the back of your card immediately. Have customer service freeze your card and issue a replacement. If you entered your login credentials, change your password immediately. Under the American Express Fraud Protection Guarantee, cardholders are typically not held liable for unauthorized charges, provided they take reasonable care and report the compromise promptly.

Why do scammers target Amex cardholders specifically?

American Express cardholders are historically high-value targets, often representing affluent consumers or corporate accounts with high credit limits. Scammers target these accounts to make large unauthorized purchases or to link the cards to digital wallets for rapid cash exfiltration. Additionally, compromising corporate Amex cards can serve as an entry point for business email compromise (BEC) and corporate network infiltration.

Conclusion

As cybercriminals deploy increasingly sophisticated, multi-step campaigns to bypass traditional security filters, relying on basic awareness is no longer enough. Achieving true digital resilience requires a holistic, layered approach to security—one that aligns technology, processes, and people.

Whether protecting personal assets or securing an enterprise network, staying ahead of credential harvesting requires constant vigilance and robust technical controls. Organizations can strengthen their defenses against sophisticated inbox threats by exploring structured Managed Email Security Services to eliminate complexity and secure critical assets.