16 ms·

Tesco Bank halts online payments after money was taken from 20K accounts

256 points by luxpir 10y ago

joosters 10y ago
I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online systems. Perhaps the attackers found a way to log in to accounts bypassing the usual security checks? But that still doesn't explain it all. All my online accounts have extra security when I create a payment to a new individual. Some have an extra password check, some have SMS validation, and so on. All of them send me a notification of a new payment being added. And yet there doesn't seem to be reports of Tesco customers getting any of these kind of messages. People only found about the losses when they logged into their accounts, or when Tesco broadcast a "we've been hacked" message to everyone. Does anyone know what could have happened here?
- spydum 10y ago
  could be entirely a software bug? Though I tend to agree that it looks worse than that.
  - zigzigzag 10y ago
    Sure. All it takes is a REST endpoint without the proper XSRF checks.
  - TACIXAT 10y ago
    This was my first thought. A lot of the replies here are going all out, but it is likely some simple web vuln that trusts the browser. /transfer_money?from_account=NNNN&to_account=MMMM&amount=$$$$ It would actually be really interesting if they faxed in transfer forms or something.
- devnull791101 10y ago
  i believe tesco is a customer services front end to hsbc, so i doubt that its a bank end/ accounting problem. since its only online payments that have been stopped it suggests a card details leak, including the security code. i imagine this would only affect cards that dont have the 2 factor (mastercard/visa) step set up. perhaps a successful phishing or malware attack which has targeted tesco users
  - sonthonax 10y ago
    No, Tesco Bank is wholly owned by Tesco; you're thinking of M&S Bank, which is a front end to HSBC.
    - devnull791101 10y ago
      i can say for sure the few times ive had issues transferring money overseas tesco customer services claim to be checking the status on an hsbc system
      - AlphaSite 10y ago
        Maybe their forex is via Hsbc?
        tankenmate 10y ago
        I think you might mean SWIFT (wordlwide) or SEPA (euro area + other EU). Forex typically means buying or selling currencies, not transferring money between parties.
        thisone 10y ago
        It's a moot point, but forex's are also used to move money internationally. It is ultimately buying and selling currencies, but you get much better rates than through the bank because the forex isn't actually moving your money. It's receiving money into accounts which are in the senders country, and then, using its accounts in the receivers country, it pays the receiver. Also means the receiver doesn't get hit with fees to receive an international payment.
- 4ndr3vv 10y ago
  From the Article "I've not heard of an attack of this nature and scale on a UK bank where it appears that the bank's central system is the target" Sounds like it's a breach from within (or at least not though compromised accounts), this would explain the lack of concern from Tesco about resting security (much to the chagrin of customers, i'm sure) and the huge numbers of affected accounts.
- throwawayReply 10y ago
  That hasn't been released, but I think it's interesting that the original press releases frames this as a matter of fraud rather than a breach. I personally doubt this will be revealed to be a software security issue.
- Quarrelsome 10y ago
  Well there hasn't been an APT (Advanced Persistent Threat) attack yet on a UK bank yet (although we've seen them on banks in the developing world). Perhaps this is the first and perhaps the attackers figures that doing many smaller transactions would work for longer than big ones.
- Roonerelli 10y ago
  there was a victim on the radio this morning saying his account had been breached. But he said the account is one he just uses for savings. He received the card in the post years ago and it has sat in his safe ever since. It's never left his house. So couldn't understand how someone could have ever got his details
  - deleted 10y ago
    [deleted]
  - Tepix 10y ago
    Sounds like the bank got breached, not the customer.
- jsingleton 10y ago
  Disclaimer: I don't use Tesco Bank so this is just speculation and some observations. The types of 2FA vary dramatically between banks. Some use an SMS OTP but as we know phone numbers aren't secure [0]. Most use a card reader but they often do this differently. Some use the 'identify' function to log on and the 'sign' function for payments (as designed) but others use the 'respond' function for everything. The danger in using 'respond' for payments is that the account and amount aren't entered into the card reader so you don't know what you are authorising. <pure-speculation> If Tesco have a flaw in how they are using 2FA, by only using 'respond', then local malware could intercept genuine payments, alter the account/amount details, and get the user to authorise this. Or Android malware could intercept SMS messages. N.B. This assumes the issue is in the faster payments system but it could be in the payment card system. It appears cash points still work but this is a separate system to debit card payments. </pure-speculation> From what I've read no one will lose money but having transactions frozen is still a big inconvenience. As mentioned elsewhere here, this is why it's a good idea to have many different bank accounts from various parent institutions (also important from a deposit guarantee position). Some banks share the same infrastructure and liability. Always have some cash available too, although that is getting harder to spend everywhere [1]. [0]: https://unop.uk/phone-numbers-for-examples-and-user-identification/ https://unop.uk/phone-numbers-for-examples-and-user-identifi... [1]: https://unop.uk/do-you-accept-cash/ https://unop.uk/do-you-accept-cash/
  - emp_zealoth 10y ago
    Welp, just because you get to have Verizon give up your phone number because someone asked nicely doesn't mean it is universally a bad idea Hell, I can't even get authenticated with my provider half the time because the simcard comes with it's ID/PIN/password that is printed on your contract. You need that to do any changes on your account. I personally think cell phones can be made secure enough and are the most convenient. If somebody really wants to fuck with you, they will anyway, for most people there is not much point to it anyway
  - dogma1138 10y ago
    Not all banking systems require 2FA, phone banking doesn't. If tested systems that allow you to transfer money between accounts, if you can bypass the initial authentication you can transfer money without needing to use 2FA or generating a TUN code. And these systems can be breached.
- mmaunder 10y ago
  Agreed with your concerns. The fact that it was widespread and no action from Tesco that indicates any understanding of what was compromised suggests they have no clue. So they may still be vulnerable. If UK customers can find a low (or no) cost alternative place to put what remains of their money, I'd do that now. This might not be over. They may not know how the attackers gained access or if they're still inside until incident responders have done a full workup on the network.
lifeisstillgood 10y ago
it seems to be money transferred from accounts (£600 mentioned as an amount). But to set up 20,000 new transfers, and extract money from them, without 2FA, and without tripping any number of alarms is a terrible failure in security. This will massively affect their provider fiserv, their internal team will almost certainly have to be replaced and I would be surprised if they don't throw their hands up and go back to being grocers. Retail banking is wafer thin margins. Edit: I cannot think of / find a similar case - this is amoungst the first if not the first mass account attack I know of. To do this there is a trace. Potentially an insider at Tesco to turn off the 2FA etc, or possibly they have penetrated the systems totally. Not sure which is worse. Also there must be some mule accounts - right now all the "Big Four" are scouring their customers accounts for unusual deposits. We will hopefully see where it went soon - presumably to several people who believed a Nigerian Prince was sending them cash, and then sent it into a wash of Russian accounts. But I would be amazed if it all gets out the country. It would trip so many alarms. Of course if it did not trip alarms Some predictions - Gov will enforce GPG level encryption for every bank interaction - 2FA with Time based OTP for example. This will force a huge upgrade in retail banking - and will be good for the economy. And Apple IPhone is the perfect host for making time based two factor auth that smooth. Good for apple. Android might just see the whole UK market as large enough to get its act together.
- sofaofthedamned 10y ago
  Yes it doesn't look for fiserv either. There have been no password resets yet, so I doubt it's a mass user endpoint issue.
  - moonbug 10y ago
    Also fiserv's share price hasn't budged.
    - twic 10y ago
      Maybe all the stolen money was used to buy Fiserv shares.
- 10y ago
diegoprzl 10y ago
I'm only surprised at this not happening every week. I suppose that completely hacking a bank is not easy to monetize, even if breaking its security is.
coldcode 10y ago
The worst thing that can happen for any bank is to have its customers' money taken away. No one will ever do business with that bank again. You can screw up everything else but lose people's money is unforgivable.
- kylebenzle 10y ago
  More like "misplaced", customers will get their money back, no question.
- elcct 10y ago
  People have short memory and they don't care. Offer like £50 sign up bonus and they'll be flocking like crazy sheep.
  - Pitarou 10y ago
    TalkTalk's recruitment drive is a good example. I would consider taking the £50, but I would make damn sure not to put ALL my funds in there.
- joosters 10y ago
  I don't think this is at all true. Customers at just about every bank are hit by fraud, a lot of it through no fault of the customer, and yet banks don't seem to spend much time tracking down the criminals. It must be far cheaper for the banks to reimburse customers rather than to patch all the security weaknesses of their financial systems. This strongly suggests that the reputational cost of hacking and fraud just isn't that big.
  - mcherm 10y ago
    > banks don't seem to spend much time tracking down the criminals I am curious how you come to this conclusion, given that banks are extremely reticent to discuss what security measure they take and to avoid any publicity about security breaches (even publicity about how they caught someone brings the problem back to the public's mind). So if they WERE being effective in tracking down the criminals, how would you know?
mstade 10y ago
And this right here is why you should have accounts with at least three separate banks, ideally in at least two different countries, and emergency funds in all of them. Also – get a couple of credit cards! Even if you never use the credit beyond what's necessary to keep it, it's good to have for when the proverbial shit hits the fan. Cash is also useful for solving the basic needs like getting food, but for paying bills it tends to be less so, since it's increasingly a pain to bay bills by cash these days. The move to cashless is unfortunately going faster than a feature parity alternative is being developed and crucially, adopted. As with almost anything financial, the key to lower risk is not putting all the eggs in a single basket.
- HoyaSaxa 10y ago
  Unfortunately, the people who are likely to be most negatively impacted by an incident like this (relatively smaller amounts taken across a large number of accounts) are not in the position to have multiple bank accounts. Someone who is living paycheck to paycheck needs to aggregate all of their funds in one bank account in order to write a check for rent, and to avoid excessive non-sufficient fund fees. Agreed that this is sage advice for anyone who is able to financially have multiple accounts though.
  - mstade 10y ago
    Unfortunately, you're right. :o( Thing is, you don't even have to have a whole lot of money to set up multiple accounts. I started doing this when I was still a student, because I got freaked out by how easy it was to skim cards back in the dizzy. (Maybe it still is, but in the EU most cards seem to smart cards these days so you can't just do the swipe skim anymore – at least, I don't think so.) I had four accounts: - A: current account, where I would receive whatever little money I'd make on the side every once in a while, and benefits - B: savings account, where I'd move most money I received in account A; this account had full freedom but pretty much no meaningful interest - C: second savings account, where I'd actually put savings; some restrictions but better interest I also had a mixed debit/credit card connected to A – it had terrible limits (something like £250) but it was enough to make purchases throughout the day. At the end of the day, I'd move funds from B to fill the credit back up, thereby never getting any penalties. It's important not to actually use this credit for more than whatever the allotted free time is. (I think I had 30 days free credit, but always paid it back immediately anyway.) A almost never had any money on it, and if I needed to make larger purchases than the credit allowed I'd just transfer it when I needed it. This setup worked well, and I had a couple of scares where my card had to be blocked, but I never lost money. My savings were abysmal (living hand to mouth) and it was the same funds moving around all the time – I just made sure that my exposure on the card was almost always the bank's money. They're pretty quick in settling things when shit hits the fan then. This setup breaks down if someone manages to hack the bank or you though, since it's all in the same bank. This is why I use multiple banks today. Obviously mileage varies by country, but my experience with banks in the EU is that once you've got an account, they're more than happy to set up more stuff for you. (Ye olde Wells Fargo trap, I s'pose.) Most banks like to insist that you use them exclusively, but I've never heeded that advice and so far I've never had a problem with it. If anything, they seem to work (ever so slightly) harder to get all of your business.
elcct 10y ago
> Tesco Bank is stressing that relatively small amounts were taken from 20,000 accounts If someone is living month to month, said £500 missing could be very serious complication of life and £25 "emergency fund" is a joke. I personally doubt a wealthy person would use that bank and yet they seem to think their customers are pissing gold.
- dan1234 10y ago
  > personally doubt a wealthy person would use that bank and yet they seem to think their customers are pissing gold. Actually they give a decent interest rate (relative to the competition) of 3% on the first £3,000[0] so I know a few people who have multiple accounts with them just to reap the interest. [0]http://www.tescobank.com/current-accounts/ http://www.tescobank.com/current-accounts/
  - elcct 10y ago
    3% minus inflation of 0.6% that would be 2.4% of £3000, which is £72 a year, which gives £6 a month. Is it worth the hassle?
    - simonh 10y ago
      I don't understand why you're subtracting inflation. Yes I know doing so gives you the 'real terms' increase in value, but if you stuff £3,000 in a mattress and pull it out after a year you don't notionally add inflation to it's value when comparing it to the value of savings. The savings in that account would still be 3% more than your mattress money, not 2.4% more. Unless you're comparing it to spending all the money right now. Anyway, £6 (or £7.50) is the price of a meal. £72 (or £90) is the price of a few decent Christmas presents. These things add up.
      - mcbuilder 10y ago
        He's probably subtracting inflation to make the interest rate of Tesco relative to the rest of the economy. Stuffing money in a mattress is a pretty poor idea when it should be very easy to find an investment scheme that covers inflation.
283894 10y ago
I just signed up for 2 Tesco accounts the other day to dump 3k in each for the 3% interest. I'm certainly not going to be doing anything with the accounts until Tesco give some more clarification on what actually happened (although the way these things work, I doubt there will ever be a full technical response.) Also if it is some sort of internal breach, would any other data have been taken? Back in 2012, Tesco were storing passwords in plain text. http://www.bbc.co.uk/news/technology-19316825 http://www.bbc.co.uk/news/technology-19316825
- simonvc 10y ago
  Tesco ask you to log on with "character 2 and 4 from your password" which sort of implies they must store the password in clear text (unless some kind of zeroknowledge/homomorphic encryption magic i've not heard of.)
  - nrki 10y ago
    This is pretty standard for UK banks. They'd do a hash of each character of the password (in Lloyds' case, your "memorable word" combo), to compare your entries to.
    - benkuhn 10y ago
      Wait, that's still awful! It allows you to crack each character individually. For instance, a 10-letter password requires 26^10 ~= 1.4e14 attempts to test every option if you only have a hash of the full password, but only 10*26 = 260 attempts to test every option for every individual character.
      - brassic 10y ago
        I have to use two passwords to login to Lloyds bank. One conventional password (which is presumably stored salted and hashed) and one where I have to enter characters from three positions they choose. The latter is intended to mitigate the risk of using your account from a vulnerable computer. The former takes care of vulnerabilities on their end (as far as any password can).
DrNuke 10y ago
Most times the snake is inside in the form of disparaged employees or corrupt managers: how are Tesco bank personnel recruited and treated, compared with their peers at more established banks?
andybak 10y ago
I know banking and retail are separate but as an organisation Tesco hasn't got a good history for security: https://www.troyhunt.com/the-tesco-hack-heres-how-it-probably/ https://www.troyhunt.com/the-tesco-hack-heres-how-it-probabl... https://www.troyhunt.com/lessons-in-website-security-anti/ https://www.troyhunt.com/lessons-in-website-security-anti/
- nthcolumn 10y ago
  I sent them multiple vuln for free for both their online shopping site and an online (yes on the internet) payroll system https://payslipview.com/Login.aspx?ReturnUrl=%2fdefault.aspx https://payslipview.com/Login.aspx?ReturnUrl=%2fdefault.aspx I had a smug thank you response.
martinald 10y ago
It looks like faster payments are still allowed, as are in person chip and pin and cash withdrawls. My guess someone (either insider or via technical means) has got a list of all the debit card numbers, ccv and account details - maybe even 3DSecure/VfV details? People are then doing loads of payments via online cardholder not present. Going to be a pain to figure what is what on this. "Ref: Customers will still be able to use their cards for cash withdrawals, chip and pin payments, and bill payments. The bank is blocking customers from making online payments using their debit card, although transfers between accounts and to other people are still allowed, a spokesperson said."

256 points by luxpir 10y ago

I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online systems. Perhaps the attackers found a way to log in to accounts bypassing the usual security checks? But that still doesn't explain it all. All my online accounts have extra security when I create a payment to a new individual. Some have an extra password check, some have SMS validation, and so on. All of them send me a notification of a new payment being added. And yet there doesn't seem to be reports of Tesco customers getting any of these kind of messages. People only found about the losses when they logged into their accounts, or when Tesco broadcast a "we've been hacked" message to everyone. Does anyone know what could have happened here?

spydum 10y ago
could be entirely a software bug? Though I tend to agree that it looks worse than that.
- zigzigzag 10y ago
  Sure. All it takes is a REST endpoint without the proper XSRF checks.
- TACIXAT 10y ago
  This was my first thought. A lot of the replies here are going all out, but it is likely some simple web vuln that trusts the browser. /transfer_money?from_account=NNNN&to_account=MMMM&amount=$$$$ It would actually be really interesting if they faxed in transfer forms or something.
devnull791101 10y ago
i believe tesco is a customer services front end to hsbc, so i doubt that its a bank end/ accounting problem. since its only online payments that have been stopped it suggests a card details leak, including the security code. i imagine this would only affect cards that dont have the 2 factor (mastercard/visa) step set up. perhaps a successful phishing or malware attack which has targeted tesco users
- sonthonax 10y ago
  No, Tesco Bank is wholly owned by Tesco; you're thinking of M&S Bank, which is a front end to HSBC.
  - devnull791101 10y ago
    i can say for sure the few times ive had issues transferring money overseas tesco customer services claim to be checking the status on an hsbc system
    - AlphaSite 10y ago
      Maybe their forex is via Hsbc?
      - tankenmate 10y ago
        I think you might mean SWIFT (wordlwide) or SEPA (euro area + other EU). Forex typically means buying or selling currencies, not transferring money between parties.
        thisone 10y ago
        It's a moot point, but forex's are also used to move money internationally. It is ultimately buying and selling currencies, but you get much better rates than through the bank because the forex isn't actually moving your money. It's receiving money into accounts which are in the senders country, and then, using its accounts in the receivers country, it pays the receiver. Also means the receiver doesn't get hit with fees to receive an international payment.
4ndr3vv 10y ago
From the Article "I've not heard of an attack of this nature and scale on a UK bank where it appears that the bank's central system is the target" Sounds like it's a breach from within (or at least not though compromised accounts), this would explain the lack of concern from Tesco about resting security (much to the chagrin of customers, i'm sure) and the huge numbers of affected accounts.
throwawayReply 10y ago
That hasn't been released, but I think it's interesting that the original press releases frames this as a matter of fraud rather than a breach. I personally doubt this will be revealed to be a software security issue.
Quarrelsome 10y ago
Well there hasn't been an APT (Advanced Persistent Threat) attack yet on a UK bank yet (although we've seen them on banks in the developing world). Perhaps this is the first and perhaps the attackers figures that doing many smaller transactions would work for longer than big ones.
Roonerelli 10y ago
there was a victim on the radio this morning saying his account had been breached. But he said the account is one he just uses for savings. He received the card in the post years ago and it has sat in his safe ever since. It's never left his house. So couldn't understand how someone could have ever got his details
- deleted 10y ago
  [deleted]
- Tepix 10y ago
  Sounds like the bank got breached, not the customer.
jsingleton 10y ago
Disclaimer: I don't use Tesco Bank so this is just speculation and some observations. The types of 2FA vary dramatically between banks. Some use an SMS OTP but as we know phone numbers aren't secure [0]. Most use a card reader but they often do this differently. Some use the 'identify' function to log on and the 'sign' function for payments (as designed) but others use the 'respond' function for everything. The danger in using 'respond' for payments is that the account and amount aren't entered into the card reader so you don't know what you are authorising. <pure-speculation> If Tesco have a flaw in how they are using 2FA, by only using 'respond', then local malware could intercept genuine payments, alter the account/amount details, and get the user to authorise this. Or Android malware could intercept SMS messages. N.B. This assumes the issue is in the faster payments system but it could be in the payment card system. It appears cash points still work but this is a separate system to debit card payments. </pure-speculation> From what I've read no one will lose money but having transactions frozen is still a big inconvenience. As mentioned elsewhere here, this is why it's a good idea to have many different bank accounts from various parent institutions (also important from a deposit guarantee position). Some banks share the same infrastructure and liability. Always have some cash available too, although that is getting harder to spend everywhere [1]. [0]: https://unop.uk/phone-numbers-for-examples-and-user-identification/ https://unop.uk/phone-numbers-for-examples-and-user-identifi... [1]: https://unop.uk/do-you-accept-cash/ https://unop.uk/do-you-accept-cash/
- emp_zealoth 10y ago
  Welp, just because you get to have Verizon give up your phone number because someone asked nicely doesn't mean it is universally a bad idea Hell, I can't even get authenticated with my provider half the time because the simcard comes with it's ID/PIN/password that is printed on your contract. You need that to do any changes on your account. I personally think cell phones can be made secure enough and are the most convenient. If somebody really wants to fuck with you, they will anyway, for most people there is not much point to it anyway
- dogma1138 10y ago
  Not all banking systems require 2FA, phone banking doesn't. If tested systems that allow you to transfer money between accounts, if you can bypass the initial authentication you can transfer money without needing to use 2FA or generating a TUN code. And these systems can be breached.
mmaunder 10y ago
Agreed with your concerns. The fact that it was widespread and no action from Tesco that indicates any understanding of what was compromised suggests they have no clue. So they may still be vulnerable. If UK customers can find a low (or no) cost alternative place to put what remains of their money, I'd do that now. This might not be over. They may not know how the attackers gained access or if they're still inside until incident responders have done a full workup on the network.

lifeisstillgood 10y ago

it seems to be money transferred from accounts (£600 mentioned as an amount). But to set up 20,000 new transfers, and extract money from them, without 2FA, and without tripping any number of alarms is a terrible failure in security. This will massively affect their provider fiserv, their internal team will almost certainly have to be replaced and I would be surprised if they don't throw their hands up and go back to being grocers. Retail banking is wafer thin margins. Edit: I cannot think of / find a similar case - this is amoungst the first if not the first mass account attack I know of. To do this there is a trace. Potentially an insider at Tesco to turn off the 2FA etc, or possibly they have penetrated the systems totally. Not sure which is worse. Also there must be some mule accounts - right now all the "Big Four" are scouring their customers accounts for unusual deposits. We will hopefully see where it went soon - presumably to several people who believed a Nigerian Prince was sending them cash, and then sent it into a wash of Russian accounts. But I would be amazed if it all gets out the country. It would trip so many alarms. Of course if it did not trip alarms Some predictions - Gov will enforce GPG level encryption for every bank interaction - 2FA with Time based OTP for example. This will force a huge upgrade in retail banking - and will be good for the economy. And Apple IPhone is the perfect host for making time based two factor auth that smooth. Good for apple. Android might just see the whole UK market as large enough to get its act together.

sofaofthedamned 10y ago
Yes it doesn't look for fiserv either. There have been no password resets yet, so I doubt it's a mass user endpoint issue.
- moonbug 10y ago
  Also fiserv's share price hasn't budged.
  - twic 10y ago
    Maybe all the stolen money was used to buy Fiserv shares.
10y ago

diegoprzl 10y ago

I'm only surprised at this not happening every week. I suppose that completely hacking a bank is not easy to monetize, even if breaking its security is.

coldcode 10y ago

The worst thing that can happen for any bank is to have its customers' money taken away. No one will ever do business with that bank again. You can screw up everything else but lose people's money is unforgivable.

kylebenzle 10y ago
More like "misplaced", customers will get their money back, no question.
elcct 10y ago
People have short memory and they don't care. Offer like £50 sign up bonus and they'll be flocking like crazy sheep.
- Pitarou 10y ago
  TalkTalk's recruitment drive is a good example. I would consider taking the £50, but I would make damn sure not to put ALL my funds in there.
joosters 10y ago
I don't think this is at all true. Customers at just about every bank are hit by fraud, a lot of it through no fault of the customer, and yet banks don't seem to spend much time tracking down the criminals. It must be far cheaper for the banks to reimburse customers rather than to patch all the security weaknesses of their financial systems. This strongly suggests that the reputational cost of hacking and fraud just isn't that big.
- mcherm 10y ago
  > banks don't seem to spend much time tracking down the criminals I am curious how you come to this conclusion, given that banks are extremely reticent to discuss what security measure they take and to avoid any publicity about security breaches (even publicity about how they caught someone brings the problem back to the public's mind). So if they WERE being effective in tracking down the criminals, how would you know?

mstade 10y ago

And this right here is why you should have accounts with at least three separate banks, ideally in at least two different countries, and emergency funds in all of them. Also – get a couple of credit cards! Even if you never use the credit beyond what's necessary to keep it, it's good to have for when the proverbial shit hits the fan. Cash is also useful for solving the basic needs like getting food, but for paying bills it tends to be less so, since it's increasingly a pain to bay bills by cash these days. The move to cashless is unfortunately going faster than a feature parity alternative is being developed and crucially, adopted. As with almost anything financial, the key to lower risk is not putting all the eggs in a single basket.

HoyaSaxa 10y ago
Unfortunately, the people who are likely to be most negatively impacted by an incident like this (relatively smaller amounts taken across a large number of accounts) are not in the position to have multiple bank accounts. Someone who is living paycheck to paycheck needs to aggregate all of their funds in one bank account in order to write a check for rent, and to avoid excessive non-sufficient fund fees. Agreed that this is sage advice for anyone who is able to financially have multiple accounts though.
- mstade 10y ago
  Unfortunately, you're right. :o( Thing is, you don't even have to have a whole lot of money to set up multiple accounts. I started doing this when I was still a student, because I got freaked out by how easy it was to skim cards back in the dizzy. (Maybe it still is, but in the EU most cards seem to smart cards these days so you can't just do the swipe skim anymore – at least, I don't think so.) I had four accounts: - A: current account, where I would receive whatever little money I'd make on the side every once in a while, and benefits - B: savings account, where I'd move most money I received in account A; this account had full freedom but pretty much no meaningful interest - C: second savings account, where I'd actually put savings; some restrictions but better interest I also had a mixed debit/credit card connected to A – it had terrible limits (something like £250) but it was enough to make purchases throughout the day. At the end of the day, I'd move funds from B to fill the credit back up, thereby never getting any penalties. It's important not to actually use this credit for more than whatever the allotted free time is. (I think I had 30 days free credit, but always paid it back immediately anyway.) A almost never had any money on it, and if I needed to make larger purchases than the credit allowed I'd just transfer it when I needed it. This setup worked well, and I had a couple of scares where my card had to be blocked, but I never lost money. My savings were abysmal (living hand to mouth) and it was the same funds moving around all the time – I just made sure that my exposure on the card was almost always the bank's money. They're pretty quick in settling things when shit hits the fan then. This setup breaks down if someone manages to hack the bank or you though, since it's all in the same bank. This is why I use multiple banks today. Obviously mileage varies by country, but my experience with banks in the EU is that once you've got an account, they're more than happy to set up more stuff for you. (Ye olde Wells Fargo trap, I s'pose.) Most banks like to insist that you use them exclusively, but I've never heeded that advice and so far I've never had a problem with it. If anything, they seem to work (ever so slightly) harder to get all of your business.

elcct 10y ago

> Tesco Bank is stressing that relatively small amounts were taken from 20,000 accounts If someone is living month to month, said £500 missing could be very serious complication of life and £25 "emergency fund" is a joke. I personally doubt a wealthy person would use that bank and yet they seem to think their customers are pissing gold.

dan1234 10y ago
> personally doubt a wealthy person would use that bank and yet they seem to think their customers are pissing gold. Actually they give a decent interest rate (relative to the competition) of 3% on the first £3,000[0] so I know a few people who have multiple accounts with them just to reap the interest. [0]http://www.tescobank.com/current-accounts/ http://www.tescobank.com/current-accounts/
- elcct 10y ago
  3% minus inflation of 0.6% that would be 2.4% of £3000, which is £72 a year, which gives £6 a month. Is it worth the hassle?
  - simonh 10y ago
    I don't understand why you're subtracting inflation. Yes I know doing so gives you the 'real terms' increase in value, but if you stuff £3,000 in a mattress and pull it out after a year you don't notionally add inflation to it's value when comparing it to the value of savings. The savings in that account would still be 3% more than your mattress money, not 2.4% more. Unless you're comparing it to spending all the money right now. Anyway, £6 (or £7.50) is the price of a meal. £72 (or £90) is the price of a few decent Christmas presents. These things add up.
    - mcbuilder 10y ago
      He's probably subtracting inflation to make the interest rate of Tesco relative to the rest of the economy. Stuffing money in a mattress is a pretty poor idea when it should be very easy to find an investment scheme that covers inflation.

283894 10y ago

I just signed up for 2 Tesco accounts the other day to dump 3k in each for the 3% interest. I'm certainly not going to be doing anything with the accounts until Tesco give some more clarification on what actually happened (although the way these things work, I doubt there will ever be a full technical response.) Also if it is some sort of internal breach, would any other data have been taken? Back in 2012, Tesco were storing passwords in plain text. http://www.bbc.co.uk/news/technology-19316825 http://www.bbc.co.uk/news/technology-19316825

simonvc 10y ago
Tesco ask you to log on with "character 2 and 4 from your password" which sort of implies they must store the password in clear text (unless some kind of zeroknowledge/homomorphic encryption magic i've not heard of.)
- nrki 10y ago
  This is pretty standard for UK banks. They'd do a hash of each character of the password (in Lloyds' case, your "memorable word" combo), to compare your entries to.
  - benkuhn 10y ago
    Wait, that's still awful! It allows you to crack each character individually. For instance, a 10-letter password requires 26^10 ~= 1.4e14 attempts to test every option if you only have a hash of the full password, but only 10*26 = 260 attempts to test every option for every individual character.
    - brassic 10y ago
      I have to use two passwords to login to Lloyds bank. One conventional password (which is presumably stored salted and hashed) and one where I have to enter characters from three positions they choose. The latter is intended to mitigate the risk of using your account from a vulnerable computer. The former takes care of vulnerabilities on their end (as far as any password can).

DrNuke 10y ago

Most times the snake is inside in the form of disparaged employees or corrupt managers: how are Tesco bank personnel recruited and treated, compared with their peers at more established banks?

andybak 10y ago

I know banking and retail are separate but as an organisation Tesco hasn't got a good history for security: https://www.troyhunt.com/the-tesco-hack-heres-how-it-probably/ https://www.troyhunt.com/the-tesco-hack-heres-how-it-probabl... https://www.troyhunt.com/lessons-in-website-security-anti/ https://www.troyhunt.com/lessons-in-website-security-anti/

nthcolumn 10y ago
I sent them multiple vuln for free for both their online shopping site and an online (yes on the internet) payroll system https://payslipview.com/Login.aspx?ReturnUrl=%2fdefault.aspx https://payslipview.com/Login.aspx?ReturnUrl=%2fdefault.aspx I had a smug thank you response.

martinald 10y ago

It looks like faster payments are still allowed, as are in person chip and pin and cash withdrawls. My guess someone (either insider or via technical means) has got a list of all the debit card numbers, ccv and account details - maybe even 3DSecure/VfV details? People are then doing loads of payments via online cardholder not present. Going to be a pain to figure what is what on this. "Ref: Customers will still be able to use their cards for cash withdrawals, chip and pin payments, and bill payments. The bank is blocking customers from making online payments using their debit card, although transfers between accounts and to other people are still allowed, a spokesperson said."