Tesco Bank Data Breach ?

grumbler

Tesco Bank Data Breach ?
- earlier thread on Bank Accounts board

mebu60

Given the above I finally decided to click through. One of the first questions from 'Experian' was wanting to know my mother's maiden name. As the breach was only supposed to be basic details and Tesco don't hold my mother's maiden name my initial suspicions are back again. I shall be contacting Tesco on Monday.

dcs34

mebu60 said:

Given the above I finally decided to click through. One of the first questions from 'Experian' was wanting to know my mother's maiden name. As the breach was only supposed to be basic details and Tesco don't hold my mother's maiden name my initial suspicions are back again. I shall be contacting Tesco on Monday.

Is that not an Experian security question, rather than any to do with the information Tesco held about you?

Could always put a wrong answer in and see what happens...

datz

I always find it disappointing that companies who lose our data always seem to believe that a one-year subscription to a CRA monitoring solution will somehow make up for it. And then it's back to business as usual as if nothing had happened.

While I take every precaution to limit the amount of information I place online (and where / with who it is shared), I've just resigned myself to the fact that it is ultimately a losing battle. Code is always going to contain vulnerabilities, companies are always going to employ the cheapest solutions, and data breaches are just an everyday occurence now - even amongst the more reputable entities. As some say - there are only those companies that have been hacked and realize it, and then those that have but don't.

Zuzi

mebu60 said:

Given the above I finally decided to click through. One of the first questions from 'Experian' was wanting to know my mother's maiden name. As the breach was only supposed to be basic details and Tesco don't hold my mother's maiden name my initial suspicions are back again. I shall be contacting Tesco on Monday.

It's a question everyone gets asked as part of the sign up process (obvs I can't see which website exactly you are accessing but if someone is signing up for Experian, they need to fill it in). You will probably have a specific link to give you the access scope Tesco has promised, but I don't see what other link to your data with Tesco there could be, they are asking just their standard signup questions...

mebu60

dcs34 said:

mebu60 said:

Given the above I finally decided to click through. One of the first questions from 'Experian' was wanting to know my mother's maiden name. As the breach was only supposed to be basic details and Tesco don't hold my mother's maiden name my initial suspicions are back again. I shall be contacting Tesco on Monday.

Is that not an Experian security question, rather than any to do with the information Tesco held about you?

Could always put a wrong answer in and see what happens...

Yes, I considered a wrong answer, mainly to see what appeared on the next screen. My initial instinct on receiving the email was that it was a scam. Asking for further irrelevant information (to the breach) has my scamdar on full alert again. 
If it is genuine Tesco have been very poor in contracting it out without any finetuning. Why should I have to give a third party additional information which would be especially useful to a scammer who has my basic details from the breach? 

Am out for the day Sunday. Will reflect and maybe try the wrong answer route Monday to see what is asked about next. 

Thanks.

mebu60

Zuzi said:

mebu60 said:

Given the above I finally decided to click through. One of the first questions from 'Experian' was wanting to know my mother's maiden name. As the breach was only supposed to be basic details and Tesco don't hold my mother's maiden name my initial suspicions are back again. I shall be contacting Tesco on Monday.

It's a question everyone gets asked as part of the sign up process (obvs I can't see which website exactly you are accessing but if someone is signing up for Experian, they need to fill it in). You will probably have a specific link to give you the access scope Tesco has promised, but I don't see what other link to your data with Tesco there could be, they are asking just their standard signup questions...

On the balance of probabilities it is most likely the standard Experian sign up form.

But it could also be that scammers have sent out an email purporting to be from Tesco using information gained from the breach and included a link to a fake Experian sign-up to garner additional information which would be incredibly valuable to them. 

Paranoid? Me? 

masonic

mebu60 said:

Given the above I finally decided to click through. One of the first questions from 'Experian' was wanting to know my mother's maiden name. As the breach was only supposed to be basic details and Tesco don't hold my mother's maiden name my initial suspicions are back again. I shall be contacting Tesco on Monday.

It's a standard security question in case you forget your Experian password. Tesco and Experian are different companies who are not sharing your personal information for the purposes of providing you access to your credit report.

mebu60 said:

dcs34 said:

mebu60 said:

Given the above I finally decided to click through. One of the first questions from 'Experian' was wanting to know my mother's maiden name. As the breach was only supposed to be basic details and Tesco don't hold my mother's maiden name my initial suspicions are back again. I shall be contacting Tesco on Monday.

Is that not an Experian security question, rather than any to do with the information Tesco held about you?

Could always put a wrong answer in and see what happens...

Yes, I considered a wrong answer, mainly to see what appeared on the next screen. My initial instinct on receiving the email was that it was a scam. Asking for further irrelevant information (to the breach) has my scamdar on full alert again. 
If it is genuine Tesco have been very poor in contracting it out without any finetuning. Why should I have to give a third party additional information which would be especially useful to a scammer who has my basic details from the breach? 

Am out for the day Sunday. Will reflect and maybe try the wrong answer route Monday to see what is asked about next. 

Thanks.

You only need to give Experian this information if you want to sign up with them for the free access to your credit report. If you don't trust Experian with your personal information, I have bad news for you... most banks and other financial institutions are sharing it with Experian and other credit reference agencies, though not security questions as these are specific to each site, and preferably should be unique to a site. It's been many years since I've provided any company with my mother's real maiden name.

mebu60 said:

Zuzi said:

mebu60 said:

Given the above I finally decided to click through. One of the first questions from 'Experian' was wanting to know my mother's maiden name. As the breach was only supposed to be basic details and Tesco don't hold my mother's maiden name my initial suspicions are back again. I shall be contacting Tesco on Monday.

It's a question everyone gets asked as part of the sign up process (obvs I can't see which website exactly you are accessing but if someone is signing up for Experian, they need to fill it in). You will probably have a specific link to give you the access scope Tesco has promised, but I don't see what other link to your data with Tesco there could be, they are asking just their standard signup questions...

On the balance of probabilities it is most likely the standard Experian sign up form.

Experian do not provide any free access to your credit report, so it is unlikely that is the case. The best you can get direct at Experian is the rather useless 'credit score'. On the balance of probabilities, you are signing up for the product you have been promised by Tesco.

mebu60 said:
But it could also be that scammers have sent out an email purporting to be from Tesco using information gained from the breach and included a link to a fake Experian sign-up to garner additional information which would be incredibly valuable to them.

This could be true, so verify that you are at the genuine Experian website with SSL certificate issued to Experian Limited before proceeding.

Katiehound

I've also had this email- sometime in the last few days.

I have credit card & savings with them (& used to have current a/cs)

I assumed the email was genuine and was going to ask the question- is it worth having a free year with.. (can't remember!)..... whoever they are offering?

Mother's maiden name is one of the basic questions and I'm fairly sure Tesco Bank has that detail for me.

10_66

Katiehound said:

I've also had this email- sometime in the last few days.

I have credit card & savings with them (& used to have current a/cs)

I assumed the email was genuine and was going to ask the question- is it worth having a free year with.. (can't remember!)..... whoever they are offering?

Mother's maiden name is one of the basic questions and I'm fairly sure Tesco Bank has that detail for me.

As too many banks have my mother's real maiden name, unfortunately, I can't swap it to something else now.  I figure it's best to have at least one year free with Experian Identity Plus than not at all, so I think I'll be signing up for it.