Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tesco Bank halts online payments after money was taken from 20K accounts

bbc.co.uk

Post reply on HN
Print view View original

31–40 of 174 posts

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#31

Post by joosters »

lifeisstillgood wrote: post #15

it seems to be money transferred from accounts (£600 mentioned as an amount). But to set up 20,000 new transfers, and extract money from them, without 2FA, and without tripping any number of alarms is a terrible failure in security. This will massively affect their provider fiserv, their internal team will almost certainly have to be replaced and I would be surprised if they don't throw their hands up and go back to…

Some predictions - Gov will enforce GPG level encryption for every bank interaction

I don't think encryption levels are anything to do with the fraud problems (at the customer facing end, at least, which I guess you are referring to because of the talk of OTP)

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#32

Post by sofaofthedamned »

mjpa wrote: post #30
mstade wrote: post #22

And this right here is why you should have accounts with at least three separate banks, ideally in at least two different countries, and emergency funds in all of them. Also – get a couple of credit cards! Even if you never use the credit beyond what's necessary to keep it, it's good to have for when the proverbial shit hits the fan. Cash is also useful for solving the basic needs like getting food, but for paying bi…

I'd rather keep my money in one place - if you've got 3 accounts in separate banks that means 3 accounts to pay attention to to make sure nothing is going out that shouldn't and also multiplies the risk factor?

Yup. As long as youre under the limit underwritten by the government it's not a problem.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#33

Post by Normal_gaussian »

mjpa wrote: post #30
mstade wrote: post #22

And this right here is why you should have accounts with at least three separate banks, ideally in at least two different countries, and emergency funds in all of them. Also – get a couple of credit cards! Even if you never use the credit beyond what's necessary to keep it, it's good to have for when the proverbial shit hits the fan. Cash is also useful for solving the basic needs like getting food, but for paying bi…

I'd rather keep my money in one place - if you've got 3 accounts in separate banks that means 3 accounts to pay attention to to make sure nothing is going out that shouldn't and also multiplies the risk factor?

So the risk of something happening is larger (but not quite 3x due to shared vulnerability and multiple event), however is risk of being locked and unable to function is significantly smaller as long as you can operate with the subset of accounts.

If you are in the position (like most) where all your account contents are guaranteed and the only thing you are hedging on is convenience vs risk of cashflow problems.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#34

Post by 283894 »

I just signed up for 2 Tesco accounts the other day to dump 3k in each for the 3% interest.

I'm certainly not going to be doing anything with the accounts until Tesco give some more clarification on what actually happened (although the way these things work, I doubt there will ever be a full technical response.)

Also if it is some sort of internal breach, would any other data have been taken?

Back in 2012, Tesco were storing passwords in plain text.

http://www.bbc.co.uk/news/technology-19316825

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#35

Post by tome »

mstade wrote: post #22

And this right here is why you should have accounts with at least three separate banks, ideally in at least two different countries, and emergency funds in all of them. Also – get a couple of credit cards! Even if you never use the credit beyond what's necessary to keep it, it's good to have for when the proverbial shit hits the fan. Cash is also useful for solving the basic needs like getting food, but for paying bi…

> ideally in at least two different countries

Is it generally easy to open accounts in countries you are not resident in?

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#36

Post by pja »

lifeisstillgood wrote: post #15

it seems to be money transferred from accounts (£600 mentioned as an amount). But to set up 20,000 new transfers, and extract money from them, without 2FA, and without tripping any number of alarms is a terrible failure in security. This will massively affect their provider fiserv, their internal team will almost certainly have to be replaced and I would be surprised if they don't throw their hands up and go back to…

Yeah, they must have found a way to add payees to the online system without needing 2FA, or else they were able to spoof the 2FA in an automated fashion. If Tesco was using SMS as a 2FA (don’t do this! it isn’t secure) then perhaps they had hacked the internal phone system so that they could intercept the 2FA challenge codes in transit?

I wonder how many mule accounts they had set up? Surely having lots of small transactions into a single account followed very quickly by a large one offshore is going to trigger fraud alerts in any modern clearing bank?

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#37

Post by pavel_lishin »

sofaofthedamned wrote: post #32
mjpa wrote: post #30

Earlier quoted context omitted.

I'd rather keep my money in one place - if you've got 3 accounts in separate banks that means 3 accounts to pay attention to to make sure nothing is going out that shouldn't and also multiplies the risk factor?

Yup. As long as youre under the limit underwritten by the government it's not a problem.

Unless that insurance policy pays off within hours of your money being gone, it absolutely is a problem.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#38

Post by irq11 »

tome wrote: post #35
mstade wrote: post #22

And this right here is why you should have accounts with at least three separate banks, ideally in at least two different countries, and emergency funds in all of them. Also – get a couple of credit cards! Even if you never use the credit beyond what's necessary to keep it, it's good to have for when the proverbial shit hits the fan. Cash is also useful for solving the basic needs like getting food, but for paying bi…

> ideally in at least two different countries Is it generally easy to open accounts in countries you are not resident in?

It depends on your country, and the country you're looking at.

If you are an American, be aware that merely having a bank account in a foreign country will make your life a lot more complicated at tax time. It's probably not worth the pain, unless you have a specific need.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#39

Post by dan1234 »

elcct wrote: post #24

> Tesco Bank is stressing that relatively small amounts were taken from 20,000 accounts If someone is living month to month, said £500 missing could be very serious complication of life and £25 "emergency fund" is a joke. I personally doubt a wealthy person would use that bank and yet they seem to think their customers are pissing gold.

> personally doubt a wealthy person would use that bank and yet they seem to think their customers are pissing gold.

Actually they give a decent interest rate (relative to the competition) of 3% on the first £3,000[0] so I know a few people who have multiple accounts with them just to reap the interest.

[0]http://www.tescobank.com/current-accounts/

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#40

Post by mcherm »

joosters wrote: post #29
coldcode wrote: post #20

The worst thing that can happen for any bank is to have its customers' money taken away. No one will ever do business with that bank again. You can screw up everything else but lose people's money is unforgivable.

I don't think this is at all true. Customers at just about every bank are hit by fraud, a lot of it through no fault of the customer, and yet banks don't seem to spend much time tracking down the criminals. It must be far cheaper for the banks to reimburse customers rather than to patch all the security weaknesses of their financial systems. This strongly suggests that the reputational cost of hacking and fraud just…

> banks don't seem to spend much time tracking down the criminals

I am curious how you come to this conclusion, given that banks are extremely reticent to discuss what security measure they take and to avoid any publicity about security breaches (even publicity about how they caught someone brings the problem back to the public's mind). So if they WERE being effective in tracking down the criminals, how would you know?

Post reply on HN