Thank you all for your replies. I know the initial post was somewhat emotional.
The only online transaction was not on public WiFi. Even on public WiFi, with up-to-date phone software, all payments traffic is HTTPS (TLS), so in majority cases, it still is safe.
I'm not bashing Amex, just highlighting that this experience goes counter to my earlier ones. I have 800+ credit, 10+ years of history and a dozen of revolving credit accounts, spending thousands monthly. 99.9% of my transactions are on CCs. The $40 in question are not the issue, it's the actions of their support is what rattled me.
To be specific:
1. First interaction. The rep should have offered to replace the card immediately as SafeKey notication meant the number was compromised. Additionally, the rep didn't recognize that the number used was Apple Pay device CC number. If they did, we wouldn't be in this situation.
2. Second interaction. The rep did recognize the transactions were through Apple Pay and took corrective action by forcefully removing all Apple Pay enrollements. At the same time, the suggestions about Apple ID password seemed off. Anyway, the rep told that the transactions won't post and will just disappear as their systems also flagged them as suspicious. It turned out not to be true.
3. Third interaction, two weeks later. The rep wasn't sure why the transactions were there and wanted to open another case as previous one was for transations that were still pending. Subsequently, their Fraud team assured me that no new request is required and the case is still open. However, they will not credit the account until the case gets processed. I was told that I don't need to pay and to actually not pay for them as these are/will be marked as disputed in their system. Again, the rep failed to recognize that the transactions were technically "paid for" as I had negative balance (sign up bonus posted on zero balance).
After writing my initial post, I recalled all my fraud / disput cases in more than a decade. 2xCapital One, 1xSynchrony(Verizon) and 1 merchant dispute with BofA card.
Cap1 - In both cases, Cap1 immediately credited the amount and took all required corrective actions, they even told me merchants I needed update CC details with and the ones that got an update automatically. To be fair, they did tell me that the investigation will continue in background but they will only reach out to me if any further action is required, otherwise, I was all set.
The fraudulent transaction were made using physical cards (no EMV), the questions asked were simple -
Did you make these transaction? - No
Where you physicaly in the state the transactions were made? - No
Is your CC with you? - Yes.
Any relatives with access to CC? - No.
Under penalty of law, could you confirm that everything you told us is true to an extent of your knowledge? - Yes
You're all set, will let you know if anything else is required.
Synchony - same thing as Cap1 procedurally, just no fancy list of merchants to update the CC with.
BofA mechant dispute - amount less than $50, the moment I went though the dispute process, they immediately returned the money and appologized for the experience. They realized that there was no point to even go through with it due to the amount and just ate the expense.
I hope it articulates my way of thinking a bit better. I want to be confident in a bank I deal with, so far the above have been good in this particular aspect.
I'm not parting with Amex just yet, time will tell.
