Tesco Bank customers money disappeared & fraud messages

colsten

Danger_Fourpence wrote: »

First time I had moved money out of the account(s) so I didn't know the process. They were literally just being used as savings accounts. Every other current account I have, and I've got a fair few, uses some sort of check on a new payee, so I don't think it's unreasonable to expect the same of Tesco.

You were only able to move your money out without further verification because the device you were using had already been verified. I am surprised that with your knowledge of cybersecurity and the dark web you didn't know about this.

Granted, if someone else had access to that physical device and had your Tesco login information (i.e. someone who you know / live with in all likelihood), they could have gone in and sent your money to themselves or an accomplice. No security is 100% foolproof.

Danger_Fourpence

colsten wrote: »

You were only able to move your money out without further verification because the device you were using had already been verified. I am surprised that with your knowledge of cybersecurity and the dark web you didn't know about this.

Granted, if someone else had access to that physical device and had your Tesco login information (i.e. someone who you know / live with in all likelihood), they could have gone in and sent your money to themselves or an accomplice. No security is 100% foolproof.

Every other current account I use works on the basis of 'new payee' rather than a device. If Tesco functions differently that's new news to me.

Danger_Fourpence

JohnRo wrote: »

Tesco have acted quickly...

Can you name a high street bank that hasn't had or caused problems for it's customers? As long as they're endeavouring to put things right I really don't see the problem. Considering they're a bit of a new kid on the block I'd say they've handled the situation very well.

They have acted quickly, but it comes down to a trust issue. I'm not saying I'd never bank with them again but let's see them get their house in order first.

The failure to personally get in touch, a week after they said they would, and explain the situation and what steps are being taken to increase security is not good enough for me. I appreciate others may be more forgiving.

Anyway let's see what arises.

colsten

Danger_Fourpence wrote: »

Every other current account I use works on the basis of 'new payee' rather than a device. If Tesco functions differently that's new news to me.

Which of your other accounts only works on a verified device? I would suggest none. That's my experience at least, and I have current accounts with all of the UK banks.

Important to note also that there is absolutely no reason to suspect that the money was taken by criminals breaking into people's Tesco online banking, setting up new payees and then sending money to those new payees.

I had money taken myself, btw.

Danger_Fourpence

colsten wrote: »

Which of your other accounts only works on a verified device? I would suggest none. That's my experience at least, and I have current accounts with all of the UK banks.

Important to note also that there is absolutely no reason to suspect that the money was taken by criminals breaking into people's Tesco online banking, setting up new payees and then sending money to those new payees.

I had money taken myself, btw.

The majority of my accounts, when making a payment to a new payee, require an initial set up code sent by mobile phone. What the requirements are with individual devices I don't know as I've never done mobile banking so couldn't comment.

My point regarding the sending of funds was that it wasn't as 'secure' as what I've used elsewhere. No inference that was the suspected port of entry. Like I said above it's a trust issue and ATM there's too much in the negative column for me.

If nothing else the episode is another wake-up call for everyone.

colsten

This in my inbox just now, allegedly from NatWest. "Pay someone without a card reader".

It looks very genuine, and who knows, it probably is. But there is just no way on God's earth that I will click on either of the two download buttons and download some stuff onto my PC.

Not that this would explain the Tesco fraud last weekend - it's just an example of how open to fraud just about ANY bank is as long as they are sending emails like this one.

YorkshireBoy

Danger_Fourpence wrote: »

The failure to personally get in touch, a week after they said they would, and explain the situation and what steps are being taken to increase security is not good enough for me.

When the numbers reached the dizzy heights of 40,000 I didn't expect anything "personal".

I appreciate others may be more forgiving.

Realistic might be a better word?

jimjames

YorkshireBoy wrote: »

When the numbers reached the dizzy heights of 40,000 I didn't expect anything "personal".Realistic might be a better word?

I thought comms have been pretty reasonable considering some previous banks issues. Text messages and notifications when I log into the app with statement from tesco explaining what they can say at the moment.

Danger_Fourpence wrote: »

The failure to personally get in touch, a week after they said they would, and explain the situation and what steps are being taken to increase security is not good enough for me. I appreciate others may be more forgiving.

Anyway let's see what arises.

Have you logged into your account since? This is the message I got when I logged in this evening:

Customer Apology and update - 14 November 2016

Normal service resumed at Tesco Bank on Wednesday 9 November 2016 following the temporary suspension of online debit transactions from current accounts on Monday 7 November 2016.
We have refunded all customer accounts which were affected by the fraud on 5/6 November and are taking every step to compensate anyone who has been out of pocket as a result of the incident. We are here to help you, so if you have any questions please e-mail, customerrelations@tescobank.com or call 0345 835 3353.
Please be reassured that none of your personal data has been lost. We are limited by what we can say publicly about how the attack took place, as this is still a criminal investigation, but we want you to know that the security and protection of your money and information remains our number one priority.
Thank you for your ongoing patience, and again, let me apologise for the inconvenience caused. We will do everything it takes to ensure you can have confidence in Tesco Bank.
Benny Higgins
Chief Executive, Tesco Bank

AnotherJoe

colsten wrote: »

This in my inbox just now, allegedly from NatWest. "Pay someone without a card reader".

It looks very genuine, and who knows, it probably is. But there is just no way on God's earth that I will click on either of the two download buttons and download some stuff onto my PC.

Not that this would explain the Tesco fraud last weekend - it's just an example of how open to fraud just about ANY bank is as long as they are sending emails like this one.

I really hope that isn't genuine but like you I fear it is and if so it shows the utter stupidity of banks effectively training users to download malware, just a matter of time.

jimjames

AnotherJoe wrote: »

I really hope that isn't genuine but like you I fear it is and if so it shows the utter stupidity of banks effectively training users to download malware, just a matter of time.

Much the same as banks calling you and expecting you to go through security with them on a call you haven't initiated.