In September, they declined a charge while I was buying a plane ticket (admittedly, in a foreign country) and froze my account. A phone call straightened that out easily enough, though I was still annoyed. Given that most of my credit card usage is travel related, one wouldn't think that buying a plane ticket for roughly $120 would be "unusual activity."
In October, I got a call and email from their fraud alert system, which did turn out to be actual fraud. (Note that this is with the new card, the one that replaced the card in the compromised database). In December, I had another attempted fraud. Both of those charges had been declined, which suggests that they can get some things right as far as "unusual activity." The second time, they again replaced my card.
Anyway, this led me to decide that I really should have a second credit card in case they froze my card due to attempted fraud when I was unreachable while traveling. Since American Airlines counts all activity, not just butt in seat miles, towards lifetime status, I applied for their card. And got declined due to "insufficient positive reports."
So I requested my credit report. And I saw that both of those replacement cards were listed as "lost or stolen card." Now, that may not be why I was declined, but my guess is that it's a red flag. Since when is either of those reasons for replacement a "lost or stolen card"? I'll write a letter attempting to get this corrected, but it is a major hassle.
Maybe I should ignore the miles and just get a card from one of the banks I have an account with.