What could be the harm in sharing my American Express statements online?

Question

I would like to store my American Express statements in Google Docs so that my virtual assistant can log the line items into my accounting spreadsheets. It is also handy so that they are in one place when it is time to show the accountant at the end of the year.

My fear is that sharing this information with somebody in the Philippines for instance, can be an invitation for identity theft.

The statements include

• My company name
• My name
• My address
• Last five digits of my account number
• Phone numbers to contact American Express
• Of course, the charges
• Balances, Payments, etc...

The alternative would be to edit the PDFs each month to just show the purchases, but the person will know my name... so I'm really only hiding the five digits and contact information.

What should I worry about?

Answer 1

American Express is great for this use case -- they have two user roles "Account Agent" and "Account Manager" which allow you to designate logins to review your account details or act on your behalf to pay bills or request service.

This scheme is designed for exactly what you are doing and offers you more security and less hassle.

More details here.

Answer 2

If someone gains access to these data, he could use social engineering approach to impersonate you - i.e. call the American Express and ask tell he he is you and he lost the access to the account and he needs the access to be reset and sent to certain email, and if they doubt it's you he would send them the statement data, even on company letterhead (which he would be able to fake since he has the data from the statements, and AE has no idea how the authentic letterhead looks like). He could also do the opposite trick - like calling your assistant or even yourself and saying something like "I'm from American Express, calling about the transaction at this-and-this date and this-and-this time, this amount, please confirm you are {your name} and your address is {your address}, I need to confirm something" - which would make it appear as he is really from AE since he knows all these details - and then ask you some detail he's missing "for security" - like your birth date or last digits of SSID or anything like that - and then use these details to impersonate you to AE.

So putting all this info together where it can be accessed by strangers does have risks. It may not work out if both you and AE personnel are vigilant and follow instructions to the letter, but we know it not always so.

Answer 3

Call me overly paranoid, but letting unknown people know your charges and your personal information is asking for trouble. They know who you are and how to find you and how much money you typically make.

If they are decent people - okay, but otherwise they have good ground for comitting a crime against you - blackmail you, con you, target thieves on you, steal your identity, anything else which you won't like if it happens. And it has noting to do with being from Philippines - disonest people are everywhere. Crimes happen all the time, just the less you expose yourself the less likely a crime will be committed against you.

My suggestion would be to share as little financial and personal data as possible, especially to share as little actual money figures as possible. Also see this question.

Answer 4

As a person who has had several part time assistants in the past I will offer you a simple piece of advise that should apply regardless of what country the assistant is located.

If you have an assistant, personal or business, virtual or otherwise, and you don't trust that person with this type of information, get a different assistant.

An assistant is someone who is supposed to make your life easier by off loading work. Modifying your records before sending them every month sounds like you are creating more work for yourself not less. Either take the leap of faith to trust your assistant or go somewhere else. An assistant that you feel you have to edit crucial information from is less than useful.

That being said, there is no fundamental reason to believe that an operation in the Philippines or anywhere else is any more or less trustworthy than an operation in your native country. However, what is at issue is the legal framework around your relationship and in particular your recourse if something goes wrong. If you and your virtual assistant are both located in the US you would have an easier time collecting damages should something go wrong.

I suggest you evaluate your level of comfort for risk vs. cost. If you feel that the risk is too high to use an overseas service versus the savings, then find someone in the states to do this work. Depending on your needs and comfort you might want to seek out a CPA or other licensed/bonded professional. Yes the cost might be higher however you might find that it is worth it for your own piece of mind.

As a side note you might even consider finding a local part-time assistant. This can often be more useful than a virtual assistant and may not cost as much as you think.

If you can live without someone being bonded. (or are willing to pay for the bonding fee) yourself, depending on your market and needs you may be able to find an existing highly qualified EA or other person that wants some after hours work.

If you are in a college town, finance, accounting or legal majors make great assistants. They will usually work a couple hours a week for "beer money", they have flexible schedules and are glad to have something pertinent to their degree to put on their resume when they graduate. Just be prepared to replace them every few years as they move on to real jobs.