Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tesco Bank halts online payments after money was taken from 20K accounts

bbc.co.uk

Post reply on HN
Print view View original

121–130 of 174 posts

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#121

Post by dogma1138 »

jsingleton wrote: post #81
joosters wrote: post #2

I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…

Disclaimer : I don't use Tesco Bank so this is just speculation and some observations. The types of 2FA vary dramatically between banks. Some use an SMS OTP but as we know phone numbers aren't secure [0]. Most use a card reader but they often do this differently. Some use the 'identify' function to log on and the 'sign' function for payments (as designed) but others use the 'respond' function for everything. The dang…

Not all banking systems require 2FA, phone banking doesn't.

If tested systems that allow you to transfer money between accounts, if you can bypass the initial authentication you can transfer money without needing to use 2FA or generating a TUN code.

And these systems can be breached.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#122

Post by 0xffff2 »

genericpseudo wrote: post #73
irq11 wrote: post #38

Earlier quoted context omitted.

It depends on your country, and the country you're looking at. If you are an American, be aware that merely having a bank account in a foreign country will make your life a lot more complicated at tax time. It's probably not worth the pain, unless you have a specific need.

It's not so bad, actually; you have to file FBAR, which will take you a couple of hours, but that's about it.

It only takes me a couple hours to do my taxes in the first place.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#123

Post by [deleted] »

283894 wrote: post #34

I just signed up for 2 Tesco accounts the other day to dump 3k in each for the 3% interest. I'm certainly not going to be doing anything with the accounts until Tesco give some more clarification on what actually happened (although the way these things work, I doubt there will ever be a full technical response.) Also if it is some sort of internal breach, would any other data have been taken? Back in 2012, Tesco were…

[deleted]

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#124

Post by 21 »

simonvc wrote: post #63
283894 wrote: post #34

I just signed up for 2 Tesco accounts the other day to dump 3k in each for the 3% interest. I'm certainly not going to be doing anything with the accounts until Tesco give some more clarification on what actually happened (although the way these things work, I doubt there will ever be a full technical response.) Also if it is some sort of internal breach, would any other data have been taken? Back in 2012, Tesco were…

Tesco ask you to log on with "character 2 and 4 from your password" which sort of implies they must store the password in clear text (unless some kind of zeroknowledge/homomorphic encryption magic i've not heard of.)

I have an account at Metro Bank in UK. One day I was on the phone with them, and to authenticate myself they asked me for characters 2/4/7 from the password.

At the same time, they advise you to never give your password away, and that they will never ask you for your (full) password.

Talk about a mixed message...

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#125

Post by twic »

moonbug wrote: post #80
sofaofthedamned wrote: post #16

Earlier quoted context omitted.

Yes it doesn't look for fiserv either. There have been no password resets yet, so I doubt it's a mass user endpoint issue.

Also fiserv's share price hasn't budged.

Maybe all the stolen money was used to buy Fiserv shares.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#126

Post by mjpa »

smcl wrote: post #74
alex_anglin wrote: post #68

Earlier quoted context omitted.

Wouldn't that be covered under deposit insurance?

Right, but until that insurance pays out you're maybe faced with a bill you cannot pay in the meantime.

One would hope Tesco would cover any costs incurred by customers that are a direct result of this. I know banks in the past have cancelled non-arranged overdraft fees when they've screwed up, but that's easier to do as it's cancelling a charge rather than actually paying money out.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#127

Post by threesixandnine »

dogma1138 wrote: post #118
alex_anglin wrote: post #68

Earlier quoted context omitted.

Wouldn't that be covered under deposit insurance?

Tesco is a bank for effectively the working poor, young and migrant workers that cannot open an account at a normal highstreet banks. These are people who may have to pay rent more than once a month, have direct debits for bills and more likely than not not have an overdraft over 100£ if at all. If your bills bounce you will end up with fines, and even a lower credit score than the one which prompted you to open an a…

I came to the UK in June this year. Both me and my wife moved because of the job. We are from another EU country.

What's interesting is that I signed us up for Tesco bank account but we were both rejected. Probably because we didn't have any history in UK yet but it still kind of sucked - now I am glad they rejected us. Ultimately the next day we went to red and blue US bank on the high street and got it all sorted within half an hour. We showed them contracts, documents and bills to our names (real estate agency through which we rent already sorted that out for us before we came) and we were done. Got our cards made at the spot as well.

So it was kind of the opposite for us. We could't get the bank account with Tesco because of their "security check" but could at the high street bank.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#128

Post by FireBeyond »

dwightgunning wrote: post #57
tome wrote: post #35

Earlier quoted context omitted.

> ideally in at least two different countries Is it generally easy to open accounts in countries you are not resident in?

I'm an Australian expat in The Netherlands with accounts in AU, here in NL, and an additional account I had setup in the US. Both the NL (even when has temp residency / work visa) and the US account were a major PITA to create.

Yeah, my accounts in the US always get flagged for manual review at creation time and "extended initial funds holding" because my SSN doesn't match my DOB (because it was issued when I got my Green Card, and not when I was born).

I've even had to convince banks that they're allowed to open an account for me in the first place...

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#129

Post by katpas »

threesixandnine wrote: post #127
dogma1138 wrote: post #118

Earlier quoted context omitted.

Tesco is a bank for effectively the working poor, young and migrant workers that cannot open an account at a normal highstreet banks. These are people who may have to pay rent more than once a month, have direct debits for bills and more likely than not not have an overdraft over 100£ if at all. If your bills bounce you will end up with fines, and even a lower credit score than the one which prompted you to open an a…

I came to the UK in June this year. Both me and my wife moved because of the job. We are from another EU country. What's interesting is that I signed us up for Tesco bank account but we were both rejected. Probably because we didn't have any history in UK yet but it still kind of sucked - now I am glad they rejected us. Ultimately the next day we went to red and blue US bank on the high street and got it all sorted w…

I think you're talking about Metro bank? I know they're literally on the high street but they're meant to be a bit more innovative/useful when you actually go into a branch.

I normally use the phrase 'High Street bank' to mean those that have a branch on most high streets and range from unhelpful to really unhelpful. That's useful to know that Metro bank are living up to a different reputation.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#130

Post by mstade »

nommm-nommm wrote: post #116
distances wrote: post #86

Earlier quoted context omitted.

Perhaps the suggestion was made from an European standpoint? Two accounts in Euros within the SEPA area [1] means no costs for currency conversions or bank transfers between your accounts. [1] https://en.wikipedia.org/wiki/Single_Euro_Payments_Area

Well, the bank in question holds GBPs, converting to/from Euros to GBPs seems incredibly inconvenient and has no real benefits. Most people get their wage in a single currency and use a single currency in their every day lives. I have a family member who gets their pension in Canadian dollars but lives in the US. Since he lives in the US he has no need for Canadian dollars. He says that his money loses a quarter of i…

Most banks I've ever done business in the EU with will let you keep a currency account, in select currencies. Having two (or more) accounts in different countries is not particularly difficult then, it's just like having a different bank account. There are usually no capital requirements either, although there may be an annual (but small) charge, and you may have to all and actually talk to someone to get it set up since it's usually not self service.
Post reply on HN