Tesco Clubcard fraud - online vouchers stolen

Nodding_Donkey

I'd love Tesco to explain how having access to someones email gave you access to their clubcard account as well (unless the passwords were the same). If you click on the forgotten password link at the Tesco login it emails you a link to reset your password. If the scrote did this they could change your password but then you wouldn't have access.

GreatBeyond

hjd wrote: »

Have you actually read through this thread and seen peoples' stories?
I personally have had my account hacked 3 times. After each time I changed all my log in details to a level of security in excess of that requested by Tesco, and it still happened again. My log in details are only used for Tesco, not anywhere else.
I have never been hacked/had my information compromised anywhere else.
The people doing this know exactly what they are doing; as soon as the quarterly statements are issued and more points/vouchers are available (and stolen ones reinstated) then they go in again and steal the new lot.
Initially Tesco accused me of lying and said I or one of my family must have spent the vouchers. Once I started emailing the ceo I finally was believed. The next 2 times Tesco just emailed me to say there has been a problem with your account and your vouchers have been cancelled and will be re-issued. They know all about the problem but are just resigned to it.

Unfortunately I can't find anything I want to get via Clubcard to use up my vouchers!

There is no need to get so defensive!

My response was directly related to the post that I quoted and based on my own experience dealing with this type of issue in a professional capacity. Had I been applying that advice to everyone on the thread I wouldn't have quoted then and then gave an answer directed to them.

Would you not actually agree that given the poster has stated that there had been an attempted breach with their Paypal account the problem is more likely to be with their details being compromised than a breach on Tescos side.

I'm not going to sit back and moan about Tesco, while having information that may prevent this poster being even further scammed and I make no apology for that, I'm sorry that this upset you.

As for the rest of your post, I'm not saying it's not possible that Tesco don't have a breach somewhere - just that it is far more likely to be a breach somewhere on the customers side.

Also the reason you would have been asked if friends and family could have used it is simply because in the vast majority of cases that is what has happened and a lot of people will jump straight in shouting fraud without checking friends and family first - I know it's an inconvenience when you are genuinely in that position but a company will always want to rule out the most common before launching an investigation.

Just out of interest - is your password being changed by who ever is accessing your account or does that password remain the same and what details are required to gain access to an account if you have forgotten that password?

It might also be an idea to ask Tesco for details of contacts you have had with them during the time of the account takeover, it could be some kind of 'social engineering' that has allowed someone to access your vouchers.

This is supposed to be a good site to check if your information has been put out online somewhere though I don't know if it will look in to everything: httpx://haveibeenpwned.com

hjd

GreatBeyond wrote: »

There is no need to get so defensive!

My response was directly related to the post that I quoted and based on my own experience dealing with this type of issue in a professional capacity. Had I been applying that advice to everyone on the thread I wouldn't have quoted then and then gave an answer directed to them.

Would you not actually agree that given the poster has stated that there had been an attempted breach with their Paypal account the problem is more likely to be with their details being compromised than a breach on Tescos side.

I'm not going to sit back and moan about Tesco, while having information that may prevent this poster being even further scammed and I make no apology for that, I'm sorry that this upset you.

As for the rest of your post, I'm not saying it's not possible that Tesco don't have a breach somewhere - just that it is far more likely to be a breach somewhere on the customers side.

Also the reason you would have been asked if friends and family could have used it is simply because in the vast majority of cases that is what has happened and a lot of people will jump straight in shouting fraud without checking friends and family first - I know it's an inconvenience when you are genuinely in that position but a company will always want to rule out the most common before launching an investigation.

Just out of interest - is your password being changed by who ever is accessing your account or does that password remain the same and what details are required to gain access to an account if you have forgotten that password?

It might also be an idea to ask Tesco for details of contacts you have had with them during the time of the account takeover, it could be some kind of 'social engineering' that has allowed someone to access your vouchers.

This is supposed to be a good site to check if your information has been put out online somewhere though I don't know if it will look in to everything: httpx://haveibeenpwned.com

Frankly, the less contact I have with Tesco the better now!
I have only ever accessed my accounts online and only contact was after the vouchers had already been stolen.
In my case no password or email address was changed; others in this thread have reported that these details had been changed by the fraudsters.
Yes, Tesco assume that someone in your family has used the vouchers but since there are only 2 of us and we were both at work 250 miles away when the vouchers were being used, that one didn't work.
Neither of us use social media either.
You may think I come across as defensive but if you had gone through the numerous phone calls, each one repeating the information which was never recorded, and been told you were lying because there was no way their systems could be hacked, you would be very unhappy about the situation.

GreatBeyond

hjd wrote: »

Frankly, the less contact I have with Tesco the better now!
I have only ever accessed my accounts online and only contact was after the vouchers had already been stolen.
In my case no password or email address was changed; others in this thread have reported that these details had been changed by the fraudsters.
Yes, Tesco assume that someone in your family has used the vouchers but since there are only 2 of us and we were both at work 250 miles away when the vouchers were being used, that one didn't work.
Neither of us use social media either.
You may think I come across as defensive but if you had gone through the numerous phone calls, each one repeating the information which was never recorded, and been told you were lying because there was no way their systems could be hacked, you would be very unhappy about the situation.

I totally understand why you are unhappy with the situation and don't blame you for not wanting to spend time continually contacting Tesco - it sounds like there has been a real lack of ownership taken for this and regardless of where the breach has originated from that is unacceptable, especially for a company the size of Tesco.

No system is unhackable and as I have said previously it's not out of the realms of possibility that a breach has come from Tesco but the post I replied to indicated that the issue was deeper than just Tesco so that does indicate that the breach has come from the customers side.

I had a look in to this issue from February and it looks like the same one that some of our customers were caught up in, people got hold of email/password combinations tried them on other sites and it worked - this does not mean that this has happened to you though. I know that when this happened the company I work for mass-mailed all customers who were potentially impacted and advised them to change passwords.

I really do hope that you get this resolved and this probably won't be of any help to you but if you need any help from the side of dealing with Customer Services ect I would be more than happy to help you out, just drop me a PM.

Anyway like I said - I really hope you get everything sorted.

Mrs_Meerkat

I had over £200 pounds worth of vouchers stolen and spent on Tuesday...19.05.2015
I had received an email telling me my email address had been changed on Tesco.com.
Straight away i went onto Tesco's website and tried to log in and couldnt.
I immediately got onto the phone to them and was eventually able to gain access to my account again and they have said they will reinstate the stolen vouchers.
Once i came off the phone to Tesco i went for a browse around my account and was gutted at what i saw.
The thief's details were all there for me to see...including everything they had bought with the vouchers on Tesco Direct.
I have printed everything off to take this further.
They used my name as the delivery name but their own delivery address...in London.
I am in Scotland.
I got back onto Tesco to tell them what i had saw and the person i spoke to said it would be dealt with but there was no elaboration.
She suggested i report it to action fraud.
I was offered a £10 voucher for my inconvenience.
I went to my local police who were not interested unless it involved actual money.
The person who gained access to my account took it over ....they were in my contact addresses and kept showing up as my email address.
If i could say the persons name and address here i would, to warn you all about this thief but no doubt i'd be in the wrong.
To make matters worse...i saw yesterday that all the stuff they ordered was actually delivered to them.
I told Tesco what was happening and i even gave them the order number so it could be stopped....but heyho, there you go. The thief got the lot.
I am sick to the stomach about this and i urge everybody to keep a close eye on their clubcard account...especially their personal details.
Its like a kick in the teeth now to log on to Tesco's website as i can see what they have done..i can see the vouchers they used and their monetary value on Tesco Direct.
Its made me see Tesco in a different light now.
I posted this elsewhere in one of the other forums but i think im in the right place now for this post.

hjd

I had accumulated over £350 Clubcard vouchers. Nothing in the boosts really appealed to me so I decided to buy a new TV.
I went to Tesco today and bought a TV costing £399. I handed over all the vouchers and then paid the balance.
At no time was I asked for my Clubcard or for any ID. I didn't have to give my name and address (which I thought was a requirement from the TV licensing people).
Therefore anyone who had access to my account/vouchers (as we have seen, this appears to be quite easy for some people to get) can just spend them, no questions asked.
I have been assured, in this thread and elsewhere in correspondence with Tesco, that you can't spend vouchers without producing the Clubcard on which the vouchers were obtained. This is obviously not true.

wealdroam

hjd wrote: »

I didn't have to give my name and address (which I thought was a requirement from the TV licensing people).

That is no longer a requirement.

horrible

This is obviously still ongoing as I received an email from Blinkbox to say that my account had been compromised including my Tesco clubcard details.

On checking my clubcard account I noticed that my outstanding vouchers had been recently been used at St Helens Extra.

This fraud seems to have been going on in the Merseyside area for a number of years and cant understand why it hasn't been sorted!!.

no1catman

hjd:


Judging by the amount of vouchers you had, seems that the previous problem you had, has (at long last) been resolved.


I agree that it was (and still is AFAIK) normal procedure to ask for the Clubcard - especially when paying with multiple vouchers. But did you a) pay with a Tesco credit card, or b) give a Clubcard anyway.
If not, I'm surprised, missing out on not only the points but also the Fuel Save e.g. 14p a litre off.

Re: CC Fraud - whilst anyone's loss of vouchers is not good, security has reduced it considerably - even the amount of posts here bares that out. For example, an change of detail done on-line gets notified back.


Yet, I suspect too that some people have had vouchers at there address in someone else's name, and not checked!

bylromarha

Happened to me tonight.

Email through from Clubcard thanking me for my order, so I go online and check.

All vouchers have been used in "ONLINE DEALS" - whatever that is.

Awaiting a response from Tesco, but worth checking out any fishy emails you get.