Tesco Clubcard fraud - online vouchers stolen

transient

peachyprice wrote: »

http://www.bbc.co.uk/news/technology-26171130

The poop has hit the fan.

Tesco are still claiming it's still only a small number of customers.

Serves half of the people right reading that

Colin2511

I have just logged in to spend vouchers on RAC -spent with no random numbers etc required -


Then hubby said to check what we had left - had to put in password and random numbers to check my account and saw £50 spent at READING EXTRA last weds - this is hundreds of miles from us, and with kids on 1/2 term - not a journey I would do (never been to Reading in my life)


I phoned up, and to be fair they have said they would credit my account now, and as the person spending had left their details on my account they would follow up with fraud etc


asked me to change password which is will, email which I wont as this is not a free one, but one linked to my domain name -


I am surprised that you don't have to put any other details than a password to spend the vouchers, but that you have to put more details into look at your account,

deanos

http://www.dailymail.co.uk/news/article-2559256/Tesco-security-breach-hackers-leak-2-000-passwords-internet-shoppers-online.html

peachyprice

Isn't this the exact same story the BBC ran a month ago?

And it still doesn't explain how we have people here who are adamant they have a different password for Tesco and those who have had vouchers stolen, changed their password and then had vouchers stolen again.

Boohoo

I had £70 of Tesco vouchers taken last November and all was sorted out.
I changed my password as requested by Tesco.
Today i got an email from "Tesco" telling me to change my Tesco.com password to a stronger one or i will not be able to use my account.
The email was addressed to me by name so i am not sure if its real or not there was no link to click.

room512

Boohoo wrote: »

Today i got an email from "Tesco" telling me to change my Tesco.com password to a stronger one or i will not be able to use my account.
The email was addressed to me by name so i am not sure if its real or not there was no link to click.

I had the same email and have just changed my password

terra_ferma

deanos wrote: »

http://www.dailymail.co.uk/news/article-2559256/Tesco-security-breach-hackers-leak-2-000-passwords-internet-shoppers-online.html

it's rather annoying that they've managed to convince everyone that it's the user's fault, rather than their weak security. A part from vouchers, clubcard accounts contain very valuable data, detailed information about every single purchase, crossed referenced to postcode. That in itself is quite worrying because it contains a lot of information about users.

marjrie_2

Has anyone been offered money a money voucher by email? That is what was just offered to me, but that would mean I could only use as face value, so now I have to wait until May to get my vouchers refunded! I was saving to do the RAC membership but now will be too late.

hjd

marjrie wrote: »

Has anyone been offered money a money voucher by email? That is what was just offered to me, but that would mean I could only use as face value, so now I have to wait until May to get my vouchers refunded! I was saving to do the RAC membership but now will be too late.

You need to go back to them and say you want to use some of the vouchers to get the RAC membership. They can do it - you may have to push, or go to the ceo's office, but don't give up. That's exactly what I did - the first time, I had logged on to renew my RAC membership to find that my vouchers had been stolen.
I managed to get it renewed through Tesco.

EtheAv8r

I too got an email requesting password change. If you log on you may find that you are forced to Request Password Reset so I guess it will be forced on everyone, because my recent new password was as strong as their old password system would allow.


They now require three of the four options:
1 Upper case
1 Lowercase
1 Number
1 Special character


Minimum of 8 characters - but no indication of what the Maximum password length, so I tried to create a 19 character password with a minimum of 4 of each of the 4 character types - and it was rejected as "not complying with password requirements". So in the end I set a 10 character password with all 4 character types.


What a joke they are!