SafeKey Frequently Asked Questions | American Express Canada

American Express SafeKey^®

Frequently Asked Questions and Terms and Conditions

Frequently Asked Questions

1. What is American Express SafeKey®?
American Express SafeKey® helps prevent unauthorized online use of your American Express® Card by confirming your identity with a dynamic One-Time Code (OTC) and/or your three-digit Card Security Code (3CSC) to complete your transaction with a participating online merchant. In some instances, SafeKey may be able to authenticate your transaction without any action required on your part.

2. Doesn’t American Express provide online fraud protection?
Yes, American Express provides online protection for all our customers through our Fraud Protection Guarantee*. American Express SafeKey has been launched as part of our continuous efforts to let our customers shop in a safer and more secure online environment.

* As long as you've taken reasonable care to protect your account details & PIN and have provided all necessary information to our Fraud Department, you will not be held responsible for any fraudulent charges.

3. Do I have to pay for American Express SafeKey?
No, you do not have to pay for this service. Data charges may apply, please check with your service provider.

4. Do I need to register for American Express SafeKey?
You are automatically enrolled for American Express SafeKey. There is no additional step that you need to take for your existing Cards, when you get new Cards, or when you open additional new accounts other than ensuring your e-mail address on file with American Express is updated for all of your American Express Cards. This also includes Supplementary Cards that you may hold.

5. How do I know if my e-mail address on file for my American Express Card is up-to-date?
You can proactively confirm the e-mail address you have on file for all your American Express Cards either by logging in to your American Express Online Account or by calling the Customer Service number on the back of your Card.

6. How do I shop with American Express SafeKey?
When you enter your American Express Card number for payment at a participating online merchant, an American Express SafeKey window will appear automatically. In some instances, you will be prompted to enter your 3-digit Card Security Code (CSC) on the back of your Card, 6-digit One-Time Code (OTC), or both 3CSC and OTC. If an OTC is required, it will be sent to your e-mail address that you have on file for that account. Once we verify your OTC and/or 3CSC, your online transaction will be processed.

7. I am making a purchase, but the American Express SafeKey screen displays a masked e-mail address that is not updated. What can I do?
When you checkout with American Express SafeKey, the masked e-mail address that we have attempted to send the One-Time Code (OTC) to is displayed. If it is not up-to-date, please update your e-mail address by logging in to your American Express Online Account or by calling the Customer Service number on the back of your Card. Once completed, please re-attempt your transaction to have a new OTC sent to your updated e-mail address, and you can complete your purchase. Any updates you make to your e-mail address on file with American Express will automatically apply to SafeKey.

8. Why is a One-Time Code (OTC) required to complete an online purchase?
The OTC helps to reduce online fraud. It is a secure way to authenticate that the customer using an American Express Card for an online purchase is the rightful owner.

9. How do I receive the One-Time Code (OTC)?
You will receive your OTC via e-mail.

10. Do I have to enter a One-Time Code (OTC) for all online purchases?
No. This measure only applies for purchases made at merchant websites that support the American Express SafeKey authentication protocols. Some online purchases may only require the 3CSC found on the back of your Card, while others may require your 3CSC in addition to your OTC.

11. Do I need to provide my e-mail address to American Express to receive the One-Time Code (OTC)?
Yes, you need to provide your e-mail address to receive the OTC. If you do not have an e-mail address on file with American Express, you will be able to complete your transaction without providing it the first two times you encounter SafeKey. Upon encountering SafeKey for the third time, you will be asked to provide your e-mail address in order to authenticate your identity and complete your transaction with your American Express Card.

12. How do I update my e-mail address with American Express?
You can update your e-mail address in multiple ways, such as by logging in to your American Express Online Account or by calling the Customer Service number on the back of your Card. Any updates you make to your e-mail address on file with American Express will automatically apply to SafeKey.

13. How long is a One-Time Code (OTC) valid for?
The OTC is valid for approximately 10 minutes after submitting your Card details to the merchant.

14. How do I know if a merchant supports American Express SafeKey?
Participating online merchants will display the American Express SafeKey logo on their websites.

15. I am checking out at an online merchant, why am I not prompted for a One-Time Code (OTC)?
If the merchant is not registered for American Express SafeKey, you will not be asked for your OTC. Only online merchants who are participating in American Express SafeKey require the American Express SafeKey OTC. In some instances, SafeKey may be able to authenticate your identity without an OTC.

16. I have Basic, additional, and Supplementary American Express Cards that are used by different people. Can I have the One-Time Code (OTC) sent to the specific person using each Card?
Yes, the account numbers for each Card are different and different contact details can be added for each Basic, additional, and Supplementary Card you have associated with your account. All that is needed is that the correct contact details be on file for each Basic, additional, and Supplementary Card.

17. I have an e-mail address on file for my Basic American Express Card. Will this information apply to all of my additional and Supplementary Cards as well?
No, each Card can have a different e-mail address associated with it. If an e-mail address has not been put on file for the additional and Supplementary Cards, please update the details on file for the Cards either by logging in to your American Express Online Account or by calling the Customer Service number on the back of your Card.

18. I am using an additional or Supplementary Card and have added my e-mail address that is different from the Basic Cardmember’s contact details. Will my e-mail address update on the additional or Supplementary Card change the e-mail address on file for the Basic Card?
No, the e-mail address update for additional or Supplementary Cards will not change the e-mail address on file for the Basic Card or other additional/Supplementary Cards.

19. It’s been over 10 minutes and I have not received my One-Time Code (OTC). Can I have it re-sent again?
The OTC is valid for approximately 10 minutes after submitting your Card details to the merchant. If you click the “Resend OTC” button within that 10 minute window, then the same OTC will be re-sent to you. If you click “Resend OTC” button after the 10 minute window expires, then you will need to start the entire transaction process again to generate a new OTC. Please also check your junk mail folder.

20. What should I do if someone has changed my e-mail address without my permission or if I identify a fraudulent purchase on my Card account?
If you ever suspect that fraudulent e-mail address changes or purchases have been made on your American Express Card account, please contact Customer Service immediately to report it by calling the number on the back of your Card.

21. Do all American Express Cards work with American Express SafeKey?
No, you can only use Cards issued by Amex Bank of Canada. Business Travel Accounts, Corporate Purchasing Cards, Corporate Meeting Cards, Prepaid Cards and Gift Cards are excluded.

22. Why don’t I have to use a One-Time Code (OTC) every time I shop at a SafeKey merchant?
We want to make your online shopping experience as secure as possible without sacrificing the convenience of shopping online. As a result, certain purchases don’t require an OTC. When you make these types of purchases, you will be shown a screen advising you of this.

23. Is it obligatory to use American Express SafeKey?
Yes, it is not possible to do a transaction with an American Express SafeKey participating merchant without using American Express SafeKey.

24. My transaction has failed. What do I need to do?
Different reasons could cause the failure of a transaction. When the 6-digit One-Time Code (OTC) or 3-digit Card Security Code (3CSC) on the back of your Card is entered incorrectly or some of the security questions have not been answered correctly, the access to SafeKey could be blocked. If the OTC was not entered within ten minutes, the transaction could expire. Technical issues in the payment service of the merchant could also disturb the transaction. Alternatively, the Card being used may be invalid or the transaction is suspected to be fraudulent. In any case, a notification of what has happened with the transaction will be displayed on your screen.

25. Access to American Express SafeKey has been blocked. What do I need to do?
Access to American Express SafeKey has been blocked for security reasons if an invalid 6-digit One-Time Code OTC or 3-digit Card Security Code (3CSC) on the back of your Card has been keyed in or if the security questions have not been answered correctly. In order to get access to American Express SafeKey please contact American Express Customer Service by calling the number on the back of your Card. After the call, you should be able to use SafeKey.

26. How else can I make shopping online safer?

Keep your e-mail address up-to-date on all of your American Express Card accounts so you can be promptly notified of any suspicious activity
Protect your e-mail account with a strong, unique password and enable any additional security options offered
Create longer length passwords using combinations of letters and numbers
Use different passwords for each of your online accounts
Don’t use predictable passwords
Change your passwords regularly
Keep your anti-virus software and firewall up-to-date to prevent fraudsters accessing your details via your computer

American Express will never e-mail you to ask you for sensitive information. If you receive a suspicious e-mail which claims to be from American Express, do not click on any links. Please forward the email to spoof@americanexpress.ca.

Terms and Conditions

American Express SafeKey is an online authentication service that provides an additional layer of security to reduce theft and fraud when buying goods and services online at participating SafeKey merchants using your American Express® Card (your “Card”).

For holders of American Express Cards issued by Amex Bank of Canada, your use of American Express SafeKey is governed by these SafeKey Terms and Conditions (“Terms”), and your American Express Cardmember Agreement. You and your mean the Cardmember using American Express SafeKey. We, us and our mean Amex Bank of Canada.

Business Travel Accounts, Corporate Purchasing Cards, Corporate Meeting Cards and Prepaid and Gift Cards are excluded from using American Express SafeKey.

These Terms contain a limitation of liability clause which limits our responsibility and liability. Please refer to the “Limitation of Liability” section of these Terms for additional details.

IMPORTANT: By using American Express SafeKey, you agree to be bound by these Terms and consent to the collection and use of your personal information (such as your email address) by us to provide the SafeKey service (for example, to verify your identity or to authenticate your transaction).

We use your information in accordance with our Privacy Code and Online Privacy Statement, as they may be amended from time to time (“Privacy Policies”). These Privacy Policies provide information such as:

What information we collect and how we collect it (for example, information to identify you and background information you provide us);
The purposes for which we collect, use and disclose your information; and
Additional examples to help you better understand how we collect, use, disclose and safeguard your personal information.

Please read these Terms carefully before using SafeKey. We recommend that you print a copy of these Terms for future reference.

1. ONE-TIME CODE

If we need to send you a One-Time Code to complete your transaction, we will send the One-Time Code to the email address you have provided that is on file with us. Your One-Time Code may only be valid for approximately ten minutes from the time you submit your Card details to the merchant (“Validating Period”). If you do not complete your transaction within the Validating Period, you will need to restart the transaction with the merchant.

You should ensure that your email messages are readily accessible before you start a transaction at a participating SafeKey merchant. You may request that we re-send your One-Time Code to you. It is your responsibility to ensure you have adequate internet connection to receive email messages otherwise you will be unable to access your One-Time Code and complete your transaction.

You must not share your One-Time Code with anyone. You must take all reasonable precautions to prevent anyone else from viewing any One-Time Code which we send to you. You should delete your One-Time Code once you have successfully completed the transaction with the merchant.

If you repeatedly enter your One-Time Code incorrectly, your access to SafeKey may be blocked and you may need to contact us to proceed with the transaction.

2. EMAIL DETAILS

If we do not have your email address on file, you will need to provide us with those details where you are prompted to do so. You will be asked certain security questions to verify your identity. If you do not answer these security questions correctly, then your access to your American Express online account may be blocked. You will need to contact us to un-block your access to your online account – see the Contact Us section below. If you forget the responses to your security questions or get the answers wrong, or if the email address you provide is invalid, not current or you are not able to receive or access your email messages, you may not be able to complete your transaction.

You can change your designated email address at any time by logging into your American Express online account or by calling the Customer Service number on the back of your Card.

IMPORTANT: If you provide us with your email address, we will update our records with this email address, and you will receive communications from us at this email address as you have consented. Your email address may be accessed by our affiliates if required by law. Please see Section 3 (Privacy) in these Terms for more details.

3. PRIVACY

American Express takes your privacy seriously and the purpose of this Section 3 is to help you understand how your personal information, will be used, disclosed, transferred and otherwise processed when SafeKey is used.

We will use personal information collected through SafeKey for the purpose of providing the American Express SafeKey service (for example, to verify your identity or to authenticate transactions) and to update your email address in American Express’ systems as described in Section 2, above.

We will collect, use, disclose and safeguard your personal information in accordance with our Privacy Code and Online Privacy Statement, as they may be amended from time to time (“Privacy Policies”). We may transfer your personal information to third party service providers or companies within the American Express family of companies outside of Canada, for example, to process transactions and to provide you with the SafeKey services. Please visit our Privacy Policies or contact us to learn more.

4. USE

You must only use American Express SafeKey, including each One-Time Code, with your own Card and only for the purpose of authenticating transactions made using your own Card.

You must comply with all of our instructions relating to the use of American Express SafeKey. You must not use American Express SafeKey for any unlawful purpose, including to commit any fraud. You also must not disclose your One-Time Code or security details to any third party.

5. LIMITATION OF LIABILITY

These terms governing our limitation of liability are in addition to the limitation of liability terms in your American Express Cardmember Agreement.

We are not responsible or liable for any costs, loss or damage you may suffer if you use American Express SafeKey, or if you are unable to complete a transaction at a participating SafeKey merchant due to factors, such as:

You not being able to receive or access your email messages (such as email messages with your One-Time Code);
The email address you provide not being valid or current;
You entering your One-Time Code incorrectly;
You forgetting the responses to your security questions or getting the answers wrong;
Any un-preventable or un-foreseeable data compromise incident, third-party hacking, or systems failure;
Your failure to comply with these Terms; or
Any damage or any viruses which may affect your computer or mobile device or any software as a result of your access to or use of American Express SafeKey.

Amex will not charge you for receiving your One-Time Code; however, American Express is not responsible for any costs incurred by you as a result of you requesting or receiving your One-Time Code. Data charges may apply, please check with your service provider.

American Express does not recommend or endorse any merchant (or their goods or services) as a result of that merchant participating in American Express SafeKey. American Express does not represent that shopping at participating American Express SafeKey merchants is risk free.

6.CHANGES/UPDATES

These Terms were last updated on the Effective Date listed at the bottom of this page.

We may stop or suspend access to American Express SafeKey at any time. We may make changes to these Terms from time to time. We will indicate that changes to these Terms have been made by updating the date indicated after "Effective Date" at the end of these Terms.

If you continue to use SafeKey after we make changes to these Terms, you will be considered to have accepted the new Terms.

7. SUSPENSION/TERMINATION

If we believe that you have provided any false, incorrect or incomplete information or if you fail to comply with any of these Terms, we can suspend or terminate your participation in American Express SafeKey.

Misuse & Fraud
If you suspect that your information is being misused, or an online transaction is unauthorized, you must notify us immediately by calling the number on the back of your Card. Visit our website to learn about our Fraud Protection Guarantee.

8. CONTACT US

If you have a question regarding American Express SafeKey, or an online transaction using American Express SafeKey, click here for the Frequently Asked Questions or call the Customer Service number on the back of your Card.

EFFECTIVE DATE: December 2015

® Registered trademark of American Express Company, used under license.

Amex Bank of Canada, P.O. Box 3204, Station F, Toronto, ON M1W 3W7

American Express SafeKey is provided under license.