Tesco Bank fined £16.4m for failings in ‘largely avoidable’ cyber attack

FCA hits bank for lacklustre approach to 2016 cyber attack in which criminals stole £2.26 million from customers

Cyber attack on company

The Financial Conduct Authority (FCA) has fined Tesco Bank 16.4 million after the supermarket giant's financial arm sustained a massive cyber attack in November 2016.

The bank failed to exercise due skill, care and diligence in an attack which saw cyber criminals make way with 2.26 million within a 48 hour period, according to the UK's financial services regulator.

An investigation ruled the attackers most likely used an algorithm to generate authentic Tesco Bank debit card numbers for 'virtual cards', and subsequently used those to engage in thousands of unauthorised transactions. This constituted a breach of the Financial Services and Markets Act 2000.

Deficiencies in Tesco Bank's design of its debit card, financial crime controls, and the team in charge of monitoring financial crime were exploited, with current account holders left vulnerable as a result. No personal data was lost or stolen, however.

Advertisement - Article continues below
Advertisement - Article continues below

"The fine the FCA imposed on Tesco Bank today reflects the fact that the FCA has no tolerance for banks that fail to protect customers from foreseeable risks," its executive director of enforcement and market oversight Mark Steward said.

"In this case, the attack was the subject of a very specific warning that Tesco Bank did not properly address until after the attack started. This was too little, too late. Customers should not have been exposed to the risk at all.

"Banks must ensure that their financial crime systems and the individuals who design and operate them work to substantially reduce the risk of such attacks occurring in the first place."

The 48-hour cyber attack began in the early hours of 5 November 2016, with Tesco Bank's fraud analysis and detection system triggered two hours later at 4:00am.

The system automatically sent text messages to account holders asking them to call about 'suspicious activity' on their accounts. The bank became aware of the attack as a result of these calls, which quickly overwhelmed the fraud prevention helpline as attempts increased.

Although Tesco Bank's controls prevented 80% of the unauthorised transactions, more than 8,000 current accounts were affected. Immediately following the attack, the perpetrators were reported to boast about their crime on the dark web, labelling the bank a "cash milking cow" and "easy to cash out".

Advertisement - Article continues below

"We are very sorry for the impact that this fraud attack had on our customers. Our priority is always the safety and security of our customers' accounts and we fully accept the FCA's notice," said Tesco Bank CEO Gerry Mallon.

"We have significantly enhanced our security measures to ensure that our customers' accounts have the highest levels of protection. I apologise to our customers for the inconvenience caused in 2016."

The FCA found that many customers suffered embarrassment and inconvenience while making payments using their debit cards, while others faced long call queues and did not receive the help they needed from Tesco Bank's call centre. The bank also applied 9,000 in charges and interest, which led to 668 unpaid direct debits on customers' accounts.

Due to Tesco Bank's cooperation with the FCA, as well as significant redress programme which fully compensated those affected, the regulator imposed a significant reduction on the 33,562,400 fine it would have otherwise issued.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now


Careers & training

A guide to cyber security certification and training

13 Jan 2020
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Hotmail.co.uk migration to Outlook.com: Qs answered

11 Nov 2019

Most Popular

Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020

Dell XPS 13 (New 9300) hands-on review: Chasing perfection

14 Jan 2020