# Fake American Express "non-compliance" card-lock phishing campaign targets Australians

> Emails impersonating American Express claim the recipient's Amex card is locked (subject cites "non-compliance issues") and send victims through a four-step fake portal that harvests the User ID, password and 3-digit card verification code (CID) before redirecting to the legitimate Amex site. Reported by MailGuard against Australian recipients, including organisations with corporate card programs.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-09-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2758
- **ID:** TL-2026-2758
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MailGuard reported a phishing campaign impersonating American Express and aimed at Australian recipients, with particular relevance to organisations that run corporate card programs. The email arrives with the display name "American Express | Non-Compliance Issues", the display and sending address donotreplyus@online.net, and the subject "Your Amex Card has been locked due to non-compliance issues". The body states the card was "temporarily locked due to unusual spending activity" and that "all card transactions and merchant payments are currently suspended", and offers a blue "Confirm your Identity" button. The pretext is deliberately mundane rather than alarming, which lowers suspicion.

The button opens a staged fake portal. Step 1 is a "Confirm access" screen that says "Tap below to verify this browser session and continue" with an "I'm ready" button, which gates the rest of the flow. Step 2 is a fake American Express sign-in page asking for User ID and Password, with a "Remember Me" checkbox. Step 3 asks for the "3-Digit CID", the security code on the card, with an illustration showing where to find it. Step 4 shows a fake error page and then redirects the victim to the legitimate American Express site, which MailGuard says is designed to leave the victim with a sense of normalcy and reduce the likelihood of the incident being reported. MailGuard reports the data harvested as the Amex login credentials, the card verification data (CID) and browser/session metadata.

The MailGuard write-up lists no URLs, phishing domains, hosting infrastructure or hashes, and makes no attribution to a named actor. Harvested credentials plus CID give an attacker what they need for account takeover and card-not-present fraud, but the source does not say how the data is monetised.

MailGuard has documented two earlier American Express kits that are listed here as related context only; the sources do not say the three campaigns share an operator. (1) 1 May 2026, "Account Limited": display name "American Express | Account Limited", pretext that the account is "temporarily restricted due to missing or incomplete information", a simple HTML email with a single link, then a four-step flow of login page (User ID/password), CID page, and a fake loading screen telling the victim not to close or refresh the page. No URLs or hosting were disclosed. (2) 14 July 2026, "Sign-In Alert": display name "American Express | Sign-In Alert", sender pattern americanonline_[recipient handle]@info.net, a "Secure Log In" button routed through a Twitter URL shortener, and a five-to-six step flow that collects User ID/password, CID, mother's maiden name, a 6-digit SMS code (showing "Invalid code" errors to encourage repeated entry) and an email one-time password. MailGuard notes that flow defeats MFA by harvesting both OTPs, enabling account takeover, fraudulent transactions, password resets and inbox compromise. The same three-part core (login, CID, benign ending) recurs across all three kits. Severity is an analyst estimate.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.005 Link Target
- T1598.003 Spearphishing Link
- T1589.001 Credentials
- T1566.002 Spearphishing Link
- T1078 Valid Accounts
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1111 Multi-Factor Authentication Interception
- T1657 Financial Theft

## Sources

- [Fake American Express "non-compliance" phishing scam targets Australians](https://www.mailguard.com.au/blog/fake-american-express-non-compliance-phishing-scam-targets-australians)
- [American Express "Sign-In Alert" phishing email leads to fake multi-step credential harvesting pages](https://www.mailguard.com.au/blog/american-express-sign-in-alert-phishing-email-leads-to-fake-multi-step-credential-harvesting-pages)
- [American Express "Account Limited" phishing scam](https://www.mailguard.com.au/blog/american-express-account-limited-phishing-scam)
- [Credit Card Security | Fraud Prevention & Security | AMEX AU](https://www.americanexpress.com/au/credit-cards/membership-benefits/service-and-security/fraud-protection/)
- [Phishing Scam Awareness & Protection | American Express US](https://www.americanexpress.com/en-us/security/phishing-scam-awareness/)
- [American Express Account Has Been Locked Email Scam - Removal and recovery steps](https://www.pcrisk.com/removal-guides/27441-american-express-account-has-been-locked-email-scam)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2758