Tesco Bank halts online payments after money was taken from 20K accounts
1–10 of 174 posts
Re: Tesco Bank halts online payments after money was taken from 20K accounts
#2I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset.
So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online systems. Perhaps the attackers found a way to log in to accounts bypassing the usual security checks? But that still doesn't explain it all.
All my online accounts have extra security when I create a payment to a new individual. Some have an extra password check, some have SMS validation, and so on. All of them send me a notification of a new payment being added. And yet there doesn't seem to be reports of Tesco customers getting any of these kind of messages. People only found about the losses when they logged into their accounts, or when Tesco broadcast a "we've been hacked" message to everyone.
Does anyone know what could have happened here?
Re: Tesco Bank halts online payments after money was taken from 20K accounts
#3I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…
could be entirely a software bug? Though I tend to agree that it looks worse than that.
Re: Tesco Bank halts online payments after money was taken from 20K accounts
#4I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…
i believe tesco is a customer services front end to hsbc, so i doubt that its a bank end/ accounting problem. since its only online payments that have been stopped it suggests a card details leak, including the security code. i imagine this would only affect cards that dont have the 2 factor (mastercard/visa) step set up. perhaps a successful phishing or malware attack which has targeted tesco users
Re: Tesco Bank halts online payments after money was taken from 20K accounts
#5I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…
i believe tesco is a customer services front end to hsbc, so i doubt that its a bank end/ accounting problem. since its only online payments that have been stopped it suggests a card details leak, including the security code. i imagine this would only affect cards that dont have the 2 factor (mastercard/visa) step set up. perhaps a successful phishing or malware attack which has targeted tesco users
No, Tesco Bank is wholly owned by Tesco; you're thinking of M&S Bank, which is a front end to HSBC.
Re: Tesco Bank halts online payments after money was taken from 20K accounts
#6I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…
i believe tesco is a customer services front end to hsbc, so i doubt that its a bank end/ accounting problem. since its only online payments that have been stopped it suggests a card details leak, including the security code. i imagine this would only affect cards that dont have the 2 factor (mastercard/visa) step set up. perhaps a successful phishing or malware attack which has targeted tesco users
That still seems odd... phishing & malware attacks are going on all the time, so a targetted strike on Tesco bank users all at the same time would be a very 'restrained' attack. Phishing would take place over several days, so the attackers would be gathering account details piece by piece. Also, the first thing that banks tend to do when a large scale phishing attack has been successful is to re-issue new passwords and card numbers, yet Tesco haven't done this. So whatever avenue of attack the hackers had, Tesco must be confident that they have closed it off without needing to junk any compromised account details?
Re: Tesco Bank halts online payments after money was taken from 20K accounts
#7I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…
i believe tesco is a customer services front end to hsbc, so i doubt that its a bank end/ accounting problem. since its only online payments that have been stopped it suggests a card details leak, including the security code. i imagine this would only affect cards that dont have the 2 factor (mastercard/visa) step set up. perhaps a successful phishing or malware attack which has targeted tesco users
Not on RBS platform anymore, they moved their current accounts off that to fiserv:
http://www.computerweekly.com/news/2240222351/Tesco-Bank-lau...
Re: Tesco Bank halts online payments after money was taken from 20K accounts
#8I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…
From the Article "I've not heard of an attack of this nature and scale on a UK bank where it appears that the bank's central system is the target"
Sounds like it's a breach from within (or at least not though compromised accounts), this would explain the lack of concern from Tesco about resting security (much to the chagrin of customers, i'm sure) and the huge numbers of affected accounts.
Re: Tesco Bank halts online payments after money was taken from 20K accounts
#9I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…
i believe tesco is a customer services front end to hsbc, so i doubt that its a bank end/ accounting problem. since its only online payments that have been stopped it suggests a card details leak, including the security code. i imagine this would only affect cards that dont have the 2 factor (mastercard/visa) step set up. perhaps a successful phishing or malware attack which has targeted tesco users
I interpreted "online payments" to mean payments to accounts via online banking, rather than credit/debit card payments online.
If it was a card details leak, I'd have expected cards to be cancelled, and not allowing them to continue to be used.
Re: Tesco Bank halts online payments after money was taken from 20K accounts
#10I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…
That hasn't been released, but I think it's interesting that the original press releases frames this as a matter of fraud rather than a breach.
I personally doubt this will be revealed to be a software security issue.