Tesco Bank have allowed my entire savings to be transferred out by telephone fraud!

rbh

I've just discovered to my absolute horror that an identity fraudster using a mobile phone managed to empty out my entire £3000 savings just 21 days after my deposit (a cheque from my Santander account sent by post) cleared in my new Tesco Bank online current account.

I have been unable to access my new Tesco Bank account since around that time and have been writing to them ever since to try to sort out the problems preventing my access and many other errors. Access was temporarily partially solved on Friday afternoon (although lost again immediately after) and I saw my account balance for the first time since early February. The £3000 was missing with no mention that it had ever been there, though I had seen it in my account online when it first cleared and before I lost access. I couldn't print it out then or now because their system wouldn't allow me to log in on my home PC with which my printer works because it is a different device to the laptop with which I registered the account (they are about 10ft apart in adjacent rooms!). I haven't used telephones by choice since 2001 and I have always refused telephone banking as I have always believed it cannot be secure. I have a landline only for broadband access with no 'phone and no mobile (I have an old mobile that has been offline/out of use for 3 years which I can resurrect and whose number I had to include in my online account application, though I chose email and post as my methods of communication, adding a note that I don't have a telephone in use). Tesco Bank know this; it was stated in my online account application and has been restated in every letter I have written to them since.

My Dad lent me his mobile on Friday afternoon so I could call Tesco Bank immediately to see where my money was. I told that a female voice (or a man pretending to be female) who they presumed to be me called them from an unknown mobile 'phone on 18th February, giving the right answers to my security questions (which I have since discovered online are the easiest way in for online hackers), added their mobile number, set up a linked account with Bank of Scotland and instigated a 'fast payment' bank transfer of the entire sum into this BofS account all of which Tesco Bank honoured without questioning!! Words cannot describe how shocked I am that Tesco Bank just facilitated all this and made no check with me by email or post to confirm nor to follow up with any relevant documentation, electronic or otherwise. Nothing about this fraud or any of the associated changes made to my account during it has been mentioned in the replies to my many letters about the various problems and errors with my new account and access to it.

It took me many years to build up this money as I earn only £1500-£2500 per annum from self-employment and receive Working Tax Credit to help pay basic bills. As soon as I topped £3000, I took Martin's advice on this website and chose Tesco Bank current account for my savings because of the 3% interest rate and no need for monthly minimum deposits which I could never guarantee.

Someone is supposed to be calling me back (I've revived the old mobile to receive their call) from Tesco Bank Fraud Department but the chap I spoke to on Friday made it sound like there was little they or the police would be able to do about it. I'm absolutely distraught. I have registered the fraud with Action Fraud online and emailed this website's most relevant news thread about it. I must be protected legally somehow and the Banking Ombudsman will surely be interested in my case if Tesco fail to recover/repay the money they have given away? For one thing, the methods used to conduct this fraud (mobile 'phone, bank transfers, etc.) are so completely against my modus operandi that alarm bells should have been ringing loudly and fraud should have been suspected!

Any help / advice would be very gratefully received!!

Yorkshire_Pud

How could the fraudster know the correct answers to your Security questions? One of them is to give two randomly chosen seperate digits from a longer security number you gave them.

As well as your name, account number etc. they might also wonder why you just abandoned your account and never checked the balance putting your account at risk. You could have used your Debit Card in an ATM to check balance and withdraw interest over the interest earning threshold.

I think these are questions Tesco Bank might ask you?

Sorry about the loss but it doesn't sound like Tesco Bank have done anything they wouldn't be expected to do providing their service.

societys_child

This sounds like something that was/is very close to home. Who could know your security details?

The £3000 was missing with no mention that it had ever been there, though I had seen it in my account online when it first cleared and before I lost access. I couldn't print it out then or now because their system wouldn't allow me to log in on my home PC with which my printer works because it is a different device to the laptop with which I registered the account (they are about 10ft apart in adjacent rooms!).

You didn't have to print it out. I'd have saved it to my hard disk.

Is anyone looking at who the BoS account belonged to?

rbh

Thank you both for your reply posts. The reason I hadn't seen my balance since I first deposited it was that soon after it cleared and I saw it, I was locked out of logging in online for some reason (which now seems like the fraud incident caused that) and I have been contacting Tesco Bank by post intermittently ever since to try to gain access to my account. I got access briefly on Friday for the first time since February but was then blocked out again.

I deposited £3000 because they only pay interest up to £3000 and not beyond so it's the maximum deposit to take advantage of the interest rate. I had no intention of touching the money; I was leaving it in there to accumulate interest, using the account as a savings account as recommended by this website. The only reason I was trying to look at it online was because my first interest should have been added at the end of the financial year (5th April) and I needed to try to print off a record/proof of interest earned as part of my annual self-employed accounts and annual tax review. I didn't need access to it for any other reason, and it would never have occured to me that it was anything other than safe and secure in there. I was just concerned that I couldn't access it if I needed to. There have been a catalogue of errors by Tesco with this account including never sending me a cheque book or paying in book (I had to request them 8 times) and sending me only an illegible PIN number for a debit/ATM card that they have only just replaced last week with a legible one. I haven't even changed that yet.

No-one could have viewed my security questions or account number here as I never wrote anything down. Only my elderly father (who cannot walk more than a couple of steps and cannot get upstairs) and I live here and we have had no visitors inside the house at all for the last 3 years because he is very poorly. I am the only person who has ever accessed my desktop computer which is at home in the upstairs room next to my bedroom and the laptop on which I set up the account has never left my bedroom. The information isn't obtained that way. It is apparently obtained by hackers breaking into the Tesco Bank online banking system remotely. I've read a number of reports since Friday of similar incidents with this and other banks and apparently the security questions are a weak point that fraudsters can easily gain access to. In one incident 2 years ago 2000 accounts were hacked into through the security questions loophole (which doesn't seem to have been improved since) and in 2010 there had been another such incident. Also, tellingly, on February 19th this year (the day after the crime was committed on my account), thousands of people had their Tesco Clubcard vouchers/points accounts emptied out entirely. It was big news, I just didn't know at the time that they had also had trouble with fraud with their bank accounts.

I said to the chap from Tesco Bank on Friday that they must have a BoS account number and name that the account was set up in even if they have no geographical location of a branch because it was presumably done online. He agreed that there was but he couldn't divulge the information to me. It sounded as if they had a recording of the telephone conversation that could be checked too. There is also a spurious mobile number set into my account which is one of the things barring my access (because I cannot confirm it as it is nothing to do with me). These will presumably be the first stages of their internal investigation which the fraud department must do. I'm just waiting to hear from them that they are starting to investigate. I've already contacted the police in the meantime....

Anthorn

This thread surprises me since Tesco Bank injects a liberal amount of red tape and boolsheet into the opening of any account. A shame they don't inject similar red tape and boolsheet to the withdrawing of funds. That might have saved your funds from theft.

colsten

You'll have to wait for Tesco to get back to you. If you haven't already done so, you should register a formal, written, complaint. http://www.tescobank.com/help/complaints/

A lot of people here have Tesco current accounts. I have had two myself for over 2 years. As you are the first person who mentions any hacking of Tesco bank accounts, it seems a problem specific to yourself. Have you checked your laptop and PC for keyloggers and other viruses?

BTW, Tesco current accounts pay interest monthly, not annually, and the date of payment is not linked to the financial year.

datlex

You need to report it as a crime to the police and let Tesco Bank Fraud Team know your crime number. Same as you would with a card clone happening. There was a program recently on BBC1 about con artists who get information from you, often without you realising.

colsten

datlex wrote: »

You need to report it as a crime to the police

OP said she had already done so.

rbh

Thank you all. Yes I did report to the police (I have a crime reference number) as well as to Tesco Bank on Friday but the customer service assistant couldn't raise anyone in the Fraud department and I am waiting to hear back from them. It doesn't seem like they're there at the weekend (I called again yesterday). I made a note on Friday of the Tesco complaints number but I always put everything in writing so I also wrote a long letter of complaint!

I might be the first person on this forum to have had a Tesco Bank account hacked but on the internet there are numerous reports going back several years of similar incidents with this and other banks and Tesco Bank have had the same security loopholes taken advantage of many times over the last few years it seems.

Just a point of interest but in my only telephone dealings with Tesco Bank which all happened on Friday and yesterday, I was asked the same two security questions in each of the three calls and the same position numbers from my security code number also on each occasion. That might not in itself highlight a security loophole but it certainly didn't vary from one instance to another!

colsten

rbh wrote: »

I might be the first person on this forum to have had a Tesco Bank account hacked but on the internet there are numerous reports going back several years of similar incidents with this and other banks and Tesco Bank have had the same security loopholes taken advantage of many times over the last few years it seems.

The Tesco current account has only been available since June 2014.

So have you now checked your PCs for keyloggers?

rbh

Thank you Colsten,
I was just quoting what I've been reading in online news going back to 2010, some involving Tesco Bank online (some from this year, some from 2014), some involving other banks (presumably the reports that I saw from earlier than 2014 then - sorry but I am in a bit of a panic, haven't eaten or slept since the grim discovery on Friday, crashing headache.....not as lucid as I would normally be), some involving Tesco Clubcard fraud events which seem to be fairly regular occurences. Also I've had constant errors and problems with this account from the beginning - a long stream of errors and omissions, letter after letter, reply after reply, most of which errors have finally been corrected last week just before the incident was discovered, some of which are still not right. It hasn't done much to inspire confidence in Tesco's banking abilities but I am still in shock at my discovery last Friday.

I'm afraid I don't understand what you mean by keyloggers. It sounds like some form of bug or hacking app or something. No-one has ever had access to either my laptop or PC but me - from new in either case - and I have up to date basic internet security on both. I'm happy to check for anything so long as the check in itself doesn't allow anything to infiltrate my systems!