Tesco Bank

karlie88

Wonder if there's been a peak in iPhone sales in Brazil?

securityguy

m00head wrote: »

According to the National Cyber Security Centre (NCSC), protecting customers (and employees) against cyber attacks is a board-level responsibility..

Quite. And most IT security failures are about general attitudes and policies. There are situations in which data is rigidly divided by sensitivity and higher protections are applied to the more sensitive data: that's the reason for "impact levels", particularly in government protectively marked environment. But those require very strong, very careful partitioning not only of networks but of operational practices, and the act of deciding which data falls into which category is much more subtle than it might at first apply.

In F1 they talk about it being much easier to make a quick but unreliable car reliable than it is to make a slow but reliable car quick. The same applies, mutatis mutandis, to security: it is very difficult to put a security culture into an IT organisation that isn't used to it. Banks have a long history of doing security, and even if the threats are no longer 12 bores and Johnny "Fingers" McSafeCracker, the basic attitude persists. Supermarkets? They regard a bit of shop-lifting as a cost of doing business, and it's a fundamentally different attitude.

You can't tell how carefully an airline maintains its aircraft's engines and wings, but if the toilets don't work it tells you something about the engineering management and attitudes. Same for finances: if they can't run a points system properly (low impact data, low motivation and capability attackers), what makes you think they can run a money system (higher impact data, higher motivation and capability attackers) any better?

[Deleted User]

One of my 2 Tesco current accounts is affected. It's showing a balance of £242 but an available balance of £0.90. I moved the rest of the money out to another bank yesterday and also emptied £3K out my other Tesco current account yesterday to another bank as a precaution. As of today, the rogue transaction(s) amounting to £241.10 aren't showing. Can we expect to see them and, if so, when, or will Tesco make sure we don't get to see them by hiding them or wiping them somehow? Can anyone in the banking industry advise on this?

pmjenkins

sharjay99 wrote: »

My card is definitely protected by VbV, half the time I struggle to remember my own password to get past it (unlike Halifax where the VbV boxs comes up but verifies itself with no need for input)

The Verified by Visa pop-up is triggered by the retailer's web site. There may be some retailers (in Brazil???) that haven't implemented this feature, or have been hacked to prevent it....

m00head

pmjenkins wrote: »

The Verified by Visa pop-up is triggered by the retailer's web site. There may be some retailers (in Brazil???) that haven't implemented this feature, or have been hacked to prevent it....

Looks like Verfied by Visa may be a red herring because not all online retailers are required to implement this feature. Contactless payments have also been frozen which implies that all the information on the front of the card has been compromised.

The question now is, has the CVV (3-digit security code) on the back of the card also been compromised? This is another feature which was supposed to reduce 'Card not Present' (CNP) fraud, because online retailers are not supposed to save this number.

If the CVV has also been compromised then this means that the hackers have obtained a database of Tesco Bank debit card numbers which includes the CVV, or the online retailer(s) targeted in this CNP fraud do not require the CVV (e.g. Amazon).

Either way, it is obvious that Tesco Bank fraud prevention systems are not working as well as they could be if they failed to block a number of relatively high value online purchases from Brazil being made at the same time by 20,000 UK customers.

Vortigern

Rollinghome wrote: »

Pretty much though more specifically I was referring using a debit card to transfer funds into broker accounts, P2P platforms etc. rather than paying bills.

YorkshireBoy wrote: »

Do you get instant value for that, or is there a clearing period?

I've used my Tesco debit card to fund investment purchases via Fidelity/Cavendish, HL and CSD at various times. Value is instant, except perhaps with CSD, so I can buy funds immediately.

My concern at the moment is a fund purchase initiated before the weekend. My Tesco account shows the reduced available balance as expected for this purchase, but what if Tesco reverse, or cancel, this transaction due to their current crisis? The broker could then reverse my purchase, sell the fund at a loss and bill me for the difference.

Rollinghome

YorkshireBoy wrote: »

Do you get instant value for that, or is there a clearing period?

With all the brokers I use I can trade instantly as settlement takes place some time after the deal is made.

Rollinghome

Vortigern wrote: »

My concern at the moment is a fund purchase initiated before the weekend. My Tesco account shows the reduced available balance as expected for this purchase, but what if Tesco reverse, or cancel, this transaction due to their current crisis? The broker could then reverse my purchase, sell the fund at a loss and bill me for the difference.

That's why their fraud department will want to speak to you if they suspect fraud to go through which payments you've authorised and which you haven't. A payment might be held up under current circumstances but is unlikely to be cancelled without your agreement. An exception might be if it was so clear to them which transactions were fraudulent - and they'd carry the can if they got it wrong.

peachyprice

jimjames wrote: »

I disagree. Points systems run by supermarket are totally different to the bank.

I disagree in this case.

With the large scale Clubcard fraud Tesco refused to acknowledge there was a serious breach in their security procedures that pointed to an inside job and placed the blame firmly on the side of the customer.

Coincidence that the same establishment now has another large scale fraud, possibly an inside job, indicating a breach in their security procedures? I doubt it.

[Deleted User]

MY missing money has been re-credited. Balance and available balance are the same!