Tesco Clubcard. Paranoia strikes again.

PhylPho

Flamin' Tesco and its paranoid IT. I haven't gone online to use my Tesco Clubcard a/c for ages but today when I tried, I've entered in my email address and password and then been taken to an additional page that's new to me, but maybe not to others?

The page asks me to key in the 10th, 12th, and 15th digit of my Clubcard number. Ah, well, right. I've all the time in the world to go get my credit card out of my wallet (it also incorporates my Clubcard account) and sift through a parade of numbers.

I thought whichever paranoid halfwit was in charge of Tesco's absurd IT department had long since been put out to grass. Apparently not. We had all this nonsense with its former Tesco Travel Card, where you needed to screw your eyes up to figure out which digit you needed to enter to get into your account. There was so much uproar about that -- ye gods, if online banking can manage with a 4 or 6 digit numeric code, why can't a supermarket chain???? -- that the great Tesco Travel Card went out of existence.

Then we had -- may still have -- the farce of Tesco "security" wanting you to tell it which computers you were using in connection with any savings account. Tesco claimed it was to help "you, the customer". Nothing to do with Tesco harvesting user / locational data, then?

If Tesco had ever been serious about online protection, or shown even a rudimentary awareness of what a keylogger is, it would've introduced virtual keyboards on its websites long since. But Tesco hasn't. Either it doesn't understand anything about IT security or it can't be bothered, most likely the latter.

Every-monumental-16-digit-code-within-which-Tesco-demands-you-find-various-numbers-if-your-eyesight's-up-to-it-helps. Though only an IT department as stunningly inept as Tesco's. Grrrrrr.

* if this is in the wrong place, then I trust the mod to move it to rants or wotever -- a minor IT chore I'd certainly never ask Tesco to undertake.

hjd

It is a new level of security introduced by Tesco and is legit.
As to effectiveness etc. - that's another story!

geordie_joe

PhylPho wrote: »

The page asks me to key in the 10th, 12th, and 15th digit of my Clubcard number. Ah, well, right. I've all the time in the world to go get my credit card out of my wallet (it also incorporates my Clubcard account) and sift through a parade of numbers.

Many people have had their club card accounts hacked and points stolen/spent. Mostly it has been because they have used the same password for several sites. All a hacker has to know is this password and your email to relieve you of your points.

Now it's a little harder as you also need to know the club card number.

I can't see the problem with Tesco increasing the security after it was shown not to be up to scratch.

If you are really so busy you can't spare a little time to find your club card, why don't you spare a little time to use your brain.

Get your club card and a piece of paper and write the club card number on the paper then keep the piece of paper under your keyboard/laptop. Then you won't need to spend your valuable time looking for your club card every time.

Also, if you use large numbers you won't have to screw up your eyes, and if you write the numbers 1 to 16 above the numbers of your club card you won't even need to count to the numbers you need.

Fredula

I think the reason they've starting doing it is because loads of people had their accounts hacked and their clubcard points stolen/used.

no1catman

The other curious thing about the post - was whether or not the op was able to 'log-on'?


I note the comment about the Credit Card, so I wonder were the Credit Card No's used? Or the separate Clubcard Number i.e. 63400490???????? or the Credit Card - only the latter will work - assuming it's one of the No's linked to the email address!

peachyprice

This will be why. You'd be even more peeved if you lost all your clubcard points.

https://forums.moneysavingexpert.com/discussion/4355059

Shame it took them 18 months to start doing something about it.

Fella

A new and 100% useless extra level of annoyance being masqueraded as added security. Anything who actually understands the slightest thing about security knows this new measure adds nothing whatsoever, except annoyance.

fridge_raider

Can you explain why it adds nothing? Genuine question, as to me it seems like it does increase security.

st999

Wait until you use a different computer or clear your cookies or re-install your browser and don't have a mobile phone number registered with them.

Fella

fridge_raider wrote: »

Can you explain why it adds nothing? Genuine question, as to me it seems like it does increase security.

Apart from the fact that my account has just been hacked for the first time ever - AFTER they added this measure?

Well, where to start. Firstly adding a question to which the answer isn't a secret is not much of a security question. Secondly if their systems are compromised externally chances are high that card numbers will be obtained as well as passwords. Thirdly if their systems are compromised internally card numbers will definitely be obtained as well as passwords. Fourthly it's quite likely that the flaws in their system don't require the hacker to logon at all (as was the case with a recent very profile case). This is just a pointless PITA measure, very characteristic of companies who have no idea how to implement security properly & resort to simply adding meaningless layers of extra questions in the hope that will do the job.

fridge_raider

All fair comments (as I say, I'm no expert on this kind of thing), but I do question why Tesco, the multi-billion pound organisation, don't have someone as clever as you who can point this out to them?

Is it that a real solution would be too costly, so it's better to implement what is essentially a PR exercise?