Tesco Bank fined £16.4m for failings in ‘largely avoidable’ cyber attack

FCA hits bank for lacklustre approach to 2016 cyber attack in which criminals stole £2.26 million from customers

Cyber attack on company

The Financial Conduct Authority (FCA) has fined Tesco Bank 16.4 million after the supermarket giant's financial arm sustained a massive cyber attack in November 2016.

The bank failed to exercise due skill, care and diligence in an attack which saw cyber criminals make way with 2.26 million within a 48 hour period, according to the UK's financial services regulator.

An investigation ruled the attackers most likely used an algorithm to generate authentic Tesco Bank debit card numbers for 'virtual cards', and subsequently used those to engage in thousands of unauthorised transactions. This constituted a breach of the Financial Services and Markets Act 2000.

Deficiencies in Tesco Bank's design of its debit card, financial crime controls, and the team in charge of monitoring financial crime were exploited, with current account holders left vulnerable as a result. No personal data was lost or stolen, however.

"The fine the FCA imposed on Tesco Bank today reflects the fact that the FCA has no tolerance for banks that fail to protect customers from foreseeable risks," its executive director of enforcement and market oversight Mark Steward said.

"In this case, the attack was the subject of a very specific warning that Tesco Bank did not properly address until after the attack started. This was too little, too late. Customers should not have been exposed to the risk at all.

"Banks must ensure that their financial crime systems and the individuals who design and operate them work to substantially reduce the risk of such attacks occurring in the first place."

The 48-hour cyber attack began in the early hours of 5 November 2016, with Tesco Bank's fraud analysis and detection system triggered two hours later at 4:00am.

The system automatically sent text messages to account holders asking them to call about 'suspicious activity' on their accounts. The bank became aware of the attack as a result of these calls, which quickly overwhelmed the fraud prevention helpline as attempts increased.

Although Tesco Bank's controls prevented 80% of the unauthorised transactions, more than 8,000 current accounts were affected. Immediately following the attack, the perpetrators were reported to boast about their crime on the dark web, labelling the bank a "cash milking cow" and "easy to cash out".

"We are very sorry for the impact that this fraud attack had on our customers. Our priority is always the safety and security of our customers' accounts and we fully accept the FCA's notice," said Tesco Bank CEO Gerry Mallon.

"We have significantly enhanced our security measures to ensure that our customers' accounts have the highest levels of protection. I apologise to our customers for the inconvenience caused in 2016."

The FCA found that many customers suffered embarrassment and inconvenience while making payments using their debit cards, while others faced long call queues and did not receive the help they needed from Tesco Bank's call centre. The bank also applied 9,000 in charges and interest, which led to 668 unpaid direct debits on customers' accounts.

Due to Tesco Bank's cooperation with the FCA, as well as significant redress programme which fully compensated those affected, the regulator imposed a significant reduction on the 33,562,400 fine it would have otherwise issued.

Featured Resources

Unleashing the power of AI initiatives with the right infrastructure

What key infrastructure requirements are needed to implement AI effectively?

Download now

Achieve today. Plan tomorrow. Making the hybrid multi-cloud journey

A Veritas webinar on implementing a hybrid multi-cloud strategy

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

The workers' experience report

How technology can spark motivation, enhance productivity and strengthen security

Download now

Recommended

SonicWall hacked via zero-day flaw in remote access tools
Security

SonicWall hacked via zero-day flaw in remote access tools

25 Jan 2021
The IT Pro Panel
Business strategy

The IT Pro Panel

25 Jan 2021
Best ransomware removal tools
ransomware

Best ransomware removal tools

22 Jan 2021
Hackers publish over 4,000 files stolen from SEPA in ransomware attack
Security

Hackers publish over 4,000 files stolen from SEPA in ransomware attack

22 Jan 2021

Most Popular

How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
WhatsApp could face €50 million GDPR fine
General Data Protection Regulation (GDPR)

WhatsApp could face €50 million GDPR fine

25 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021