Tesco Bank fined £16.4m for failings in ‘largely avoidable’ cyber attack

FCA hits bank for lacklustre approach to 2016 cyber attack in which criminals stole £2.26 million from customers

Cyber attack on company

The Financial Conduct Authority (FCA) has fined Tesco Bank 16.4 million after the supermarket giant's financial arm sustained a massive cyber attack in November 2016.

The bank failed to exercise due skill, care and diligence in an attack which saw cyber criminals make way with 2.26 million within a 48 hour period, according to the UK's financial services regulator.

Advertisement - Article continues below

An investigation ruled the attackers most likely used an algorithm to generate authentic Tesco Bank debit card numbers for 'virtual cards', and subsequently used those to engage in thousands of unauthorised transactions. This constituted a breach of the Financial Services and Markets Act 2000.

Deficiencies in Tesco Bank's design of its debit card, financial crime controls, and the team in charge of monitoring financial crime were exploited, with current account holders left vulnerable as a result. No personal data was lost or stolen, however.

"The fine the FCA imposed on Tesco Bank today reflects the fact that the FCA has no tolerance for banks that fail to protect customers from foreseeable risks," its executive director of enforcement and market oversight Mark Steward said.

"In this case, the attack was the subject of a very specific warning that Tesco Bank did not properly address until after the attack started. This was too little, too late. Customers should not have been exposed to the risk at all.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"Banks must ensure that their financial crime systems and the individuals who design and operate them work to substantially reduce the risk of such attacks occurring in the first place."

The 48-hour cyber attack began in the early hours of 5 November 2016, with Tesco Bank's fraud analysis and detection system triggered two hours later at 4:00am.

The system automatically sent text messages to account holders asking them to call about 'suspicious activity' on their accounts. The bank became aware of the attack as a result of these calls, which quickly overwhelmed the fraud prevention helpline as attempts increased.

Although Tesco Bank's controls prevented 80% of the unauthorised transactions, more than 8,000 current accounts were affected. Immediately following the attack, the perpetrators were reported to boast about their crime on the dark web, labelling the bank a "cash milking cow" and "easy to cash out".

"We are very sorry for the impact that this fraud attack had on our customers. Our priority is always the safety and security of our customers' accounts and we fully accept the FCA's notice," said Tesco Bank CEO Gerry Mallon.

Advertisement - Article continues below

"We have significantly enhanced our security measures to ensure that our customers' accounts have the highest levels of protection. I apologise to our customers for the inconvenience caused in 2016."

The FCA found that many customers suffered embarrassment and inconvenience while making payments using their debit cards, while others faced long call queues and did not receive the help they needed from Tesco Bank's call centre. The bank also applied 9,000 in charges and interest, which led to 668 unpaid direct debits on customers' accounts.

Due to Tesco Bank's cooperation with the FCA, as well as significant redress programme which fully compensated those affected, the regulator imposed a significant reduction on the 33,562,400 fine it would have otherwise issued.

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement
Advertisement

Recommended

The IT Pro Panel
Business strategy

The IT Pro Panel

27 Jul 2020
Andrew Daniels joins Druva as CIO and CISO
Cloud

Andrew Daniels joins Druva as CIO and CISO

22 Jul 2020
What is a gap analysis?
Business strategy

What is a gap analysis?

15 Jul 2020
What is a DDoS attack?
Security

What is a DDoS attack?

8 Jul 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
How do you build a great customer experience?
Sponsored

How do you build a great customer experience?

20 Jul 2020