Yeah, they must have found a way to add payees to the online system without needing 2FA, or else they were able to spoof the 2FA in an automated fashion. If Tes

Yeah, they must have found a way to add payees to the online system without needing 2FA, or else they were able to spoof the 2FA in an automated fashion. If Tesco was using SMS as a 2FA (don’t do this! it isn’t secure) then perhaps they had hacked the internal phone system so that they could intercept the 2FA challenge codes in transit? I wonder how many mule accounts they had set up? Surely having lots of small transactions into a single account followed very quickly by a large one offshore is going to trigger fraud alerts in any modern clearing bank?