Tesco Bank fined £16.4m for failings in ‘largely avoidable’ cyber attack

FCA hits bank for lacklustre approach to 2016 cyber attack in which criminals stole £2.26 million from customers

Cyber attack on company

The Financial Conduct Authority (FCA) has fined Tesco Bank 16.4 million after the supermarket giant's financial arm sustained a massive cyber attack in November 2016.

The bank failed to exercise due skill, care and diligence in an attack which saw cyber criminals make way with 2.26 million within a 48 hour period, according to the UK's financial services regulator.

An investigation ruled the attackers most likely used an algorithm to generate authentic Tesco Bank debit card numbers for 'virtual cards', and subsequently used those to engage in thousands of unauthorised transactions. This constituted a breach of the Financial Services and Markets Act 2000.

Deficiencies in Tesco Bank's design of its debit card, financial crime controls, and the team in charge of monitoring financial crime were exploited, with current account holders left vulnerable as a result. No personal data was lost or stolen, however.

"The fine the FCA imposed on Tesco Bank today reflects the fact that the FCA has no tolerance for banks that fail to protect customers from foreseeable risks," its executive director of enforcement and market oversight Mark Steward said.

"In this case, the attack was the subject of a very specific warning that Tesco Bank did not properly address until after the attack started. This was too little, too late. Customers should not have been exposed to the risk at all.

"Banks must ensure that their financial crime systems and the individuals who design and operate them work to substantially reduce the risk of such attacks occurring in the first place."

The 48-hour cyber attack began in the early hours of 5 November 2016, with Tesco Bank's fraud analysis and detection system triggered two hours later at 4:00am.

The system automatically sent text messages to account holders asking them to call about 'suspicious activity' on their accounts. The bank became aware of the attack as a result of these calls, which quickly overwhelmed the fraud prevention helpline as attempts increased.

Although Tesco Bank's controls prevented 80% of the unauthorised transactions, more than 8,000 current accounts were affected. Immediately following the attack, the perpetrators were reported to boast about their crime on the dark web, labelling the bank a "cash milking cow" and "easy to cash out".

"We are very sorry for the impact that this fraud attack had on our customers. Our priority is always the safety and security of our customers' accounts and we fully accept the FCA's notice," said Tesco Bank CEO Gerry Mallon.

"We have significantly enhanced our security measures to ensure that our customers' accounts have the highest levels of protection. I apologise to our customers for the inconvenience caused in 2016."

The FCA found that many customers suffered embarrassment and inconvenience while making payments using their debit cards, while others faced long call queues and did not receive the help they needed from Tesco Bank's call centre. The bank also applied 9,000 in charges and interest, which led to 668 unpaid direct debits on customers' accounts.

Due to Tesco Bank's cooperation with the FCA, as well as significant redress programme which fully compensated those affected, the regulator imposed a significant reduction on the 33,562,400 fine it would have otherwise issued.

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
The IT Pro Panel
Business strategy

The IT Pro Panel

29 Nov 2021
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

9 Nov 2021
What is ethical AI?
artificial intelligence (AI)

What is ethical AI?

8 Oct 2021

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

24 Nov 2021