American Express has an insecure login. When you enter the URL http://www.americanexpress.com (a natural enough place to go take care of your accounts, and the address that comes on the bill), you’re redirected to this page. Note that it’s an “http” site, not an “https.”

You can get a secure login by adding an “s” to the URL and reloading the page, but most people wouldn’t know to do that, and you shouldn’t have to. There’s no link to a secure option, and they shouldn’t even allow a non-secured login. This is kind of amazing for a company with the reputation of AmEx.