Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tesco Bank halts online payments after money was taken from 20K accounts

bbc.co.uk

Post reply on HN
Print view View original

21–30 of 174 posts

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#21

Post by Quarrelsome »

joosters wrote: post #2

I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…

Well there hasn't been an APT (Advanced Persistent Threat) attack yet on a UK bank yet (although we've seen them on banks in the developing world). Perhaps this is the first and perhaps the attackers figures that doing many smaller transactions would work for longer than big ones.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#22

Post by mstade »

And this right here is why you should have accounts with at least three separate banks, ideally in at least two different countries, and emergency funds in all of them. Also – get a couple of credit cards! Even if you never use the credit beyond what's necessary to keep it, it's good to have for when the proverbial shit hits the fan. Cash is also useful for solving the basic needs like getting food, but for paying bills it tends to be less so, since it's increasingly a pain to bay bills by cash these days. The move to cashless is unfortunately going faster than a feature parity alternative is being developed and crucially, adopted.

As with almost anything financial, the key to lower risk is not putting all the eggs in a single basket.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#23

Post by Roonerelli »

joosters wrote: post #2

I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…

there was a victim on the radio this morning saying his account had been breached. But he said the account is one he just uses for savings. He received the card in the post years ago and it has sat in his safe ever since. It's never left his house. So couldn't understand how someone could have ever got his details

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#24

Post by elcct »

> Tesco Bank is stressing that relatively small amounts were taken from 20,000 accounts

If someone is living month to month, said £500 missing could be very serious complication of life and £25 "emergency fund" is a joke. I personally doubt a wealthy person would use that bank and yet they seem to think their customers are pissing gold.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#25

Post by kylebenzle »

coldcode wrote: post #20

The worst thing that can happen for any bank is to have its customers' money taken away. No one will ever do business with that bank again. You can screw up everything else but lose people's money is unforgivable.

More like "misplaced", customers will get their money back, no question.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#26

Post by HoyaSaxa »

mstade wrote: post #22

And this right here is why you should have accounts with at least three separate banks, ideally in at least two different countries, and emergency funds in all of them. Also – get a couple of credit cards! Even if you never use the credit beyond what's necessary to keep it, it's good to have for when the proverbial shit hits the fan. Cash is also useful for solving the basic needs like getting food, but for paying bi…

Unfortunately, the people who are likely to be most negatively impacted by an incident like this (relatively smaller amounts taken across a large number of accounts) are not in the position to have multiple bank accounts. Someone who is living paycheck to paycheck needs to aggregate all of their funds in one bank account in order to write a check for rent, and to avoid excessive non-sufficient fund fees.

Agreed that this is sage advice for anyone who is able to financially have multiple accounts though.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#27

Post by elcct »

coldcode wrote: post #20

The worst thing that can happen for any bank is to have its customers' money taken away. No one will ever do business with that bank again. You can screw up everything else but lose people's money is unforgivable.

People have short memory and they don't care. Offer like £50 sign up bonus and they'll be flocking like crazy sheep.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#28

Post by [deleted] »

Roonerelli wrote: post #23
joosters wrote: post #2

I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…

there was a victim on the radio this morning saying his account had been breached. But he said the account is one he just uses for savings. He received the card in the post years ago and it has sat in his safe ever since. It's never left his house. So couldn't understand how someone could have ever got his details

[deleted]

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#29

Post by joosters »

coldcode wrote: post #20

The worst thing that can happen for any bank is to have its customers' money taken away. No one will ever do business with that bank again. You can screw up everything else but lose people's money is unforgivable.

I don't think this is at all true. Customers at just about every bank are hit by fraud, a lot of it through no fault of the customer, and yet banks don't seem to spend much time tracking down the criminals.

It must be far cheaper for the banks to reimburse customers rather than to patch all the security weaknesses of their financial systems. This strongly suggests that the reputational cost of hacking and fraud just isn't that big.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#30

Post by mjpa »

mstade wrote: post #22

And this right here is why you should have accounts with at least three separate banks, ideally in at least two different countries, and emergency funds in all of them. Also – get a couple of credit cards! Even if you never use the credit beyond what's necessary to keep it, it's good to have for when the proverbial shit hits the fan. Cash is also useful for solving the basic needs like getting food, but for paying bi…

I'd rather keep my money in one place - if you've got 3 accounts in separate banks that means 3 accounts to pay attention to to make sure nothing is going out that shouldn't and also multiplies the risk factor?
Post reply on HN