Live data from Hacker News

Tesco Bank halts online payments after money was taken from 20K accounts

bbc.co.uk

71–80 of 174 posts

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#71
post #60
post #42

Earlier quoted context omitted.

3% minus inflation of 0.6% that would be 2.4% of £3000, which is £72 a year, which gives £6 a month. Is it worth the hassle?

With Brexit uncertainty the current GBP inflation is over 20%. 3% is a drop in an ocean on that.

The UK doesn't import everything.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#72
post #63
post #34

I just signed up for 2 Tesco accounts the other day to dump 3k in each for the 3% interest. I'm certainly not going to be doing anything with the accounts until Tesco give some more clarification on what actually happened (although the way these things work, I doubt there will ever be a full technical response.) Also if it is some sort of internal breach, would any other data have been taken? Back in 2012, Tesco were…

Tesco ask you to log on with "character 2 and 4 from your password" which sort of implies they must store the password in clear text (unless some kind of zeroknowledge/homomorphic encryption magic i've not heard of.)

This is pretty standard for UK banks.

They'd do a hash of each character of the password (in Lloyds' case, your "memorable word" combo), to compare your entries to.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#73
post #38
post #35

Earlier quoted context omitted.

> ideally in at least two different countries Is it generally easy to open accounts in countries you are not resident in?

It depends on your country, and the country you're looking at. If you are an American, be aware that merely having a bank account in a foreign country will make your life a lot more complicated at tax time. It's probably not worth the pain, unless you have a specific need.

It's not so bad, actually; you have to file FBAR, which will take you a couple of hours, but that's about it.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#74
post #53

Earlier quoted context omitted.

In many instances the amount taken is significantly more than £500 too. One colleague has had £800 taken. He's quite stressed right now.

Wouldn't that be covered under deposit insurance?

Right, but until that insurance pays out you're maybe faced with a bill you cannot pay in the meantime.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#75
post #48

Earlier quoted context omitted.

I don't understand why you're subtracting inflation. Yes I know doing so gives you the 'real terms' increase in value, but if you stuff £3,000 in a mattress and pull it out after a year you don't notionally add inflation to it's value when comparing it to the value of savings. The savings in that account would still be 3% more than your mattress money, not 2.4% more. Unless you're comparing it to spending all the mon…

He's probably subtracting inflation to make the interest rate of Tesco relative to the rest of the economy. Stuffing money in a mattress is a pretty poor idea when it should be very easy to find an investment scheme that covers inflation.

It's not like the rest of the economy is immune from inflation though. Do we adjust everything for inflation? It just strikes me as pointless complication. Really, the only point I can think of is comparing saving to outright immediate spending.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#76
post #60

Earlier quoted context omitted.

With Brexit uncertainty the current GBP inflation is over 20%. 3% is a drop in an ocean on that.

The UK doesn't import everything.

Whether you like it or not the USD is the world peg right now and a currencies worth in USD is its true measure of inflation. What the national bank prints is negligible in comparison.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#77
post #53

Earlier quoted context omitted.

In many instances the amount taken is significantly more than £500 too. One colleague has had £800 taken. He's quite stressed right now.

Wouldn't that be covered under deposit insurance?

He'll get the money back. There's no doubt about that. The stress is more about not knowing how long it will take nor whatever complications may arise while this is all getting sorted. Also Tesco Bank's (understandably) busy customer services aren't helping peoples stress levels either.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#78
post #72
post #63

Earlier quoted context omitted.

Tesco ask you to log on with "character 2 and 4 from your password" which sort of implies they must store the password in clear text (unless some kind of zeroknowledge/homomorphic encryption magic i've not heard of.)

This is pretty standard for UK banks. They'd do a hash of each character of the password (in Lloyds' case, your "memorable word" combo), to compare your entries to.

Wait, that's still awful! It allows you to crack each character individually. For instance, a 10-letter password requires 26^10 ~= 1.4e14 attempts to test every option if you only have a hash of the full password, but only 10*26 = 260 attempts to test every option for every individual character.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#79
post #53
post #24

> Tesco Bank is stressing that relatively small amounts were taken from 20,000 accounts If someone is living month to month, said £500 missing could be very serious complication of life and £25 "emergency fund" is a joke. I personally doubt a wealthy person would use that bank and yet they seem to think their customers are pissing gold.

In many instances the amount taken is significantly more than £500 too. One colleague has had £800 taken. He's quite stressed right now.

I'm wondering why the individual the amounts were so (relatively speaking) small? Perhaps some strategy to avoid tripping warning systems.

Do you know if the the £800 was all there was in that particular account?

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#80

it seems to be money transferred from accounts (£600 mentioned as an amount). But to set up 20,000 new transfers, and extract money from them, without 2FA, and without tripping any number of alarms is a terrible failure in security. This will massively affect their provider fiserv, their internal team will almost certainly have to be replaced and I would be surprised if they don't throw their hands up and go back to…

Yes it doesn't look for fiserv either. There have been no password resets yet, so I doubt it's a mass user endpoint issue.

Also fiserv's share price hasn't budged.
Post reply on HN