Tesco Clubcard fraud - online vouchers stolen

molerat

Wywth wrote: »

Top 25 most frequently used, and hence guessed, passwords of 2012

Be afraid, be very afraid...

I remember many years ago being on a course for the new computer system we were getting. 20 in a class with a terminal each and had to set it up with a 8 character password. The instructor said that as usual 75% of us had used the same password, says a lot about how the brain works.

fragmented

I see there are a couple of unofficial tesco clubcard android app's available. Wonder if something like that could be the cause.

Have not had any vouchers missing but some of my christmas saver payments have not shown on my account and after 4 phone calls (2 via tesco staff at the local store who saw the recipes) still not sorted out

hjd

Lagoon wrote: »

Have just seen this thread. Can I check, all who've lost Clubcard vouchers, did you all find that your password wasn't letting you in and select 'forgotten password'?

It's possible that you've had something downloaded to your computer that's made this happen. When you load the normal Tesco clubcard site, it's actually a 'fake' site which loads in its place. It looks the same, the domain is the same, there's no clue that you're ANYWHERE other than the Tesco site. You type your username and password, THEN you get the 'password not recognised' message. By then, you've already given your username and password to the person collecting the data. What happens afterwards is that they'll access your account, change the details, and by the time you regain access your account's been compromised.

You've not accessed a dodgy link through an email on this occasion - you've typed the web address in, and you're STILL not on the right website.

No, I never had the problem of password not letting me in and have never selected "forgotten password". I just logged in as normal, typing in the web address, to find vouchers had been used elsewhere.

terra_ferma

I read the article above, a while back, but what I was actually referring to cases where this system was used, as opposed as to what might happen.
I always try and distinguish between myth and fact E.g. you could have little aliens taking over your pc through a virus/worm and use a keylogger to see your password, but doesn't actually happen very often to ordinary people.

I think Tesco is trying to blame the victims rather than admit that there is something wrong with their security systems, it's quite insulting to the people who have been victims of this fraud to assume they have all been using the same unsafe password everywhere, and that's how they got conned.

deanos

my missing £96 has just appeared in the account today as 3 new vouchers

worth checking you account folks to see if you have been refunded

Pawan_2

Thanks MSE for the [URL="hhttp://www.moneysavingexpert.com/news/shopping/2013/03/tesco-clubcard-fraud-victims-urged-change-passwords"]update[/URL]

Whilst this may possibly explain how some (but not all) of the accounts were hacked, Teco still doesn't explain how these passwords were obtained, nor does it explain how vouchers were used in stores.

Our vouchers were stolen and used in store (presumably printed off by the fraudsters when they hacked our online account) and Tesco had assured us that they couldn't be used without a valid clubcard ...... so there was still some breach of security in order for someone to be able to use them in store (with a scam card? or the need to have a clubcard was over-ridden?)

arealhighlander

At the weekend I got an email to say my Clubcard registered email address had successfully been carried out.

I couldnt get a hold of Tescos till a few hours later as I was offshore. Got the address reset and then couldnt reset my password. Their Tech Support said there was an ongoing problem with resetting PW after the registered email was changed and they would delete teh account (it wouldnt affect the Clubcard).

Just back from offshore, re-registered today and found £125.50 was removed from my vouchers on 22nd March (same day I got email), I now have £4 in vouchers remaining.

Past closing time for Customer support, so will call in the morning, do I just say these vouchers have been illegally removed? Will they re-credit ok or have they been trying to blame users "poor security"?

1jim

So are these stolen vouchers being credited back to accounts now? I was told by the rewards helpline it wouldn't be until may?

deanos

i received a letter this week apologising and included were re issued vouchers

paulieuk_2

I have just discovered I was defrauded two days ago.

Tesco says that my Clubcard was used when £20.50 of vouchers were spent at a store I have never previously been to in a part of London I do not visit, and the transaction earned 20 points.

The telephone agent also pointed to the fact that only four of my five unspent vouchers had been used.

The clear insinuation was that this was not suspicious or fraudulent because thieves would have used all unspent vouchers and not have part-paid in cash and had 20 points added to the account.

When challenged about tracing the IP address of the computer used to print off the vouchers (as the ones sent to me are still in my possession), there was nothing forthcoming.

All I am able to do, apparently, is write to Dundee. Meanwhile I had him cancel the one remaining voucher so it can't be used, but he wouldn't cancel the card number which has somehow been duplicated or cloned.