1. Consumer should always be able to blacklist a merchant or provide a whitelist
2. Consumer should always be able to set limit how much a given merchant can ever charge him/her and during what time windows
3. Consumer should always be able to set total limit of charges he/she wants to have at any time
4. Consumer should always be able to get phone number, mailing address and correct full legal name of any merchant who puts charge
5. Consumer should always be able to generate new electronic card number for online usage and dispose off any previous one at will
"Check your statements" is an useless advice. My experience is that even when you find out bad charge, you have to go through hoops and appeals which may take weeks or even months. There are zero guarantees same charge from same merchant won't happen again. The only single case when CC companies are willing to take off charge immediately is when you say you don't recognize merchant at all and its 100% fraudulent. If you say you once authorized that merchants a decade ago, its suddenly your fault and you are looking at writing up justifications which will likely get rejected any way.
You're telling me how you think the universe ought to be but my advice was about how the universe is.
It's simply utterly bananas that all it takes is for someone to get a few numbers from me, and then they have the ability to arbitrarily take my money, making it my problem to dispute it. This goes for credit cards and ACH transfers (which only require routing number and account number). The company who figures out how to fix this will have it made.
To what extent they "have it made" is an open question, but I am curious what you have to say about their signup process.
That's not quite true. The card network can refuse a merchant for any reason, constantly making bogus charges would probably be a good reason for the network to refuse them and that's likely to be the result. Of course you don't see if your bogus charge was reflective of 0.01% of the charges from this merchant or 99.9%
However as I've explained on HN a few times there's an important distinction between two separate payment card processes: Authorization and Settlement.
Authorization is the one with PINs and online referral and even getting a call from your bank about "possible fraud". Authorization protects the bank from fraud by customers (you're a necessary evil to them) and merchants by automatically collecting evidence that both authorized this to happen. Once upon a time that meant taking an "impression" and a few merchants still do that, today it may mean redirecting customers to a half-arsed HTTPS site or an EMV PIN terminal.
Settlement moves money. The merchant tells the network that they want $85.26 from card #1234567890 and usually that will just result in them receiving $85.26
These two systems aren't tied together. If there are two authorizations against your card this week for $20.00 and $35.26 but also three settlements for $19.86, $209.42 and $20.00 respectively, it's likely no alarm bells go off, this is fine, you pay $249.28
One reason it is this way is that while Settlement is essential to the idea in the first place (if the merchants don't get money what's the point?), Authorization is dozens of extra things tacked on over time and so each has to be optional or the system would fail.
This means important safeguards in Authorization don't actually safeguard you, only your issuer (in your case Amex)
For example: Modern Authorization schemes are replay resistant. When you pay with an EMV card the merchant gets a one-time "cryptogram" that isn't reusable. Buying a $5 product, walking out of the store, then realising you needed two, so you go back and buy another $5 product results in two entirely different cryptograms for the two Authorizations. The store can't present a third Authorization because it would need a new cryptogram.
BUT Settlement isn't replay resistant. When (not if, this really happens) an IT mistake results in running all the Settlement for a merchant twice, customers just all get charged twice, again no flags are raised automatically, it will take until either somebody confesses their error or more likely angry customers start calling their issuers to complain.
For individuals the only advice is: Check your statements, demand that line items you can't explain be reversed, and try to pick an issuer who is on your side.