Dive Brief:

• American Express keeps extensive and granular data on each of its customers, including credit histories, spending histories, and credit scores, the network’s group president of global commercial services and credit and fraud risk, Anna Marrs, revealed at a conference last week.
• The credit card network taps troves of consumer data kept in its own records and from third parties, such as credit reporting agencies, to determine the level of risk for business owners and individual cardholders, without imposing a preset spending limit, she said at the 25th Annual Scotiabank Financials Summit in Toronto on Wednesday.
• "We can look at that transaction, relative to recent transaction history and your overall balance," Marrs said. "We know about your industry, we know about you and your personal FICO [score], and we can say 'is that transaction a go, or a no-go?"

Dive Insight:

When asked how the New York City-based company moderates risk without preset spending limits, a guardrail intended to prevent overspending, Marrs at first made a joke about her sworn secrecy on the matter. “We can’t tell you, actually, it’s the secret sauce,” she said.

Following some laughs, Marrs spoke at length about how the company handles its risk.

The company first leans on publicly available credit histories. In the United States, three major companies provide credit reports on consumers: Equifax, TransUnion and Experian. Those companies track consumers’ spending history, the debt they’ve accumulated along the way and their past bill payments.

Amex also reviews consumers’ account balances, spending history and whether or not they’re a business owner, Marrs said.

“We ingest a lot of third-party data from various bureaus and commercial data sources around the world, and we combine that with our own data,” she said. “Any time you swipe your card around the world, it’s a real-time decision engine that decides whether to accept or decline the transaction. It’s that flexibility and the real-time nature of [that] means we don’t have to set a limit.”

At the same time, American Express has “a longstanding commitment” to customer privacy, Melanie Backs, the company’s vice president of financial and policy communications, said in response to emailed questions. “We provide our customers with choices for managing their own data privacy preferences through our website,” she said, stressing that customers are not liable for fraudulent charges.

She also noted that “American Express does not sell customers’ personal information and only shares such information as necessary to provide our products and services to the customer, where we have previously informed or been authorized to do so by the customer.”

In addition to consumer services, American Express provides special cards and other services, such as checking accounts and loans, to small businesses, which give them the data it needs to determine how much the owners of those businesses should spend, she said.

“When you can see the cash flow, that’s an incredibly important data source,” Marrs said. “That lets you provide a larger [credit] line size if you can see cash in the account or good cash flow.”

Marrs stressed that small businesses have to give Amex permission to peek into their bank accounts.

Extensive data collection brings with it worries over privacy, cybersecurity and fraud.

Recent high-profile data breaches in which credit card information was stolen from thousands of Americans have almost certainly contributed to those concerns. LiveNation, which owns the ticket-order giant Ticketmaster, revealed in a May regulatory filing that customer credit card information was stolen in a data breach.