This is how cyber attackers stole £2.26m from Tesco Bank customers

October 1, 2018 TH Author

The inner workings of a cyber attack against Tesco Bank which saw £2.26m stolen from 9,000 customers – and resulted in the bank being fined over £16.4m for the failings that allowed it happen – have been revealed.

The Financial Conduct Authority (FCA) has hit the bank with a £16.4m fine and said Tesco Bank failed to “exercise due skill, care and diligence” in protecting current account holders against a cyber attack.

Almost two years on from the incident, the exact identity of the cyber criminals is still unknown, but the FCA’s newly published report into the Tesco Bank attack details how hackers were able to make off with over £2m over the course of 48 hours in November 2016.

The attack started at 02:00 on Saturday, 5 November 2016; by 04:00, Tesco Bank’s fraud analysis and detection system started sending automatic text messages to the banks personal current account holders asking them to call about “suspicious activity” on their accounts, which is how the bank itself first became aware of the attack.

As the fraud attempts increased, the calls quickly overwhelmed Tesco Bank’s fraud prevention line. Although Tesco Bank’s controls stopped almost 80 percent of the unauthorised transactions, the attack affected 8,261 out of 131,000 Tesco Bank personal current accounts.

The attackers most likely used an algorithm which generated authentic Tesco Bank debit card numbers and, using those virtual cards, they attempted to make thousands of unauthorised debit card transactions.

The FCA said Tesco Bank’s failures include the way in which the bank distributed debit card numbers and mistakes made in the reaction to the attack which meant that no action was taken for almost a day after the incident was first uncovered.

A number of deficiencies in the way Tesco Bank handled security left customers vulnerable to cyber attackers in an incident that was “largely avoidable”, said the FCA analysis of the incident which Tesco Bank had to this point been tight-lipped about – to the frustration of other financial institutions.

Poor design of Tesco Bank debit cards played a significant role in creating security vulnerabilities which led to thousands of customers having their accounts emptied. One of these involved the PAN numbers – the 16 digit card number sequence used to identify all debit cards.

Tesco Bank inadvertently issued debit cards with sequential PAN numbers. This increased the likelihood that the attackers would find the next PAN number in the sequence.

It took 21 hours after the attack began before Tesco Bank’s Fraud Strategy Team was informed about the incident.

Only after what the FCA describes as a “series of errors” – including Tesco Bank’s Financial Crime Operations Team sending an email to the wrong address instead of making a phone call as procedure requires – was the fraud team made aware of the attack.

In all that time, nothing had been done to stop the attacks, with fraudulent transactions continuing to siphon money from accounts as the bank received more and more calls from worried customers.

It was only one the Fraud Strategy Team had finally been alerted that some headway was made into countering the attack. It was found that the vast majority of transactions were coming from Brazil and were using a payment method known as ‘PoS 91’ – making transactions based on magnetic stripes which carry identifying information about the debit card.

This payment method is widely used outside of Europe and crucially doesn’t limit the value or number of transactions – and the number of successful attacks showed that the attackers had acquired the relevant PAN numbers.

Once PoS 91 was identified as the most frequently used channel for fraudulent transactions and Brazil as the location they were occurring, Tesco Bank’s Fraud Strategy Team put a rule in place to block those transactions from 1:48am on Sunday 6th November – almost a full 24 hours after the attack began.

But the trouble didn’t end there: errors were made in the implementation of this rule which made it ineffective – they used the Euro currency code instead of Brazil’s country code – and nobody noticed this until later.

As a result, the number of attempted transitions continued to rise, reaching 80,000 by Monday 7 November – with Tesco Bank blocking 90 percent of these.

In an effort to counter this, Tesco Bank brought in external experts to uncover the problem in fraud detection systems that allowed these to go through – it turned out to be a coding error by Tesco Bank’s Financial Crime Operations Team had made when it originally programmed the fraud detection system.

By the time this was discovered, it was almost two days after the fraudulent transactions started and customers had lost a combined total of £2.26m to cyber criminals.

Overall, the FCA found that Tesco Bank failed exercise due skill, care and diligence to the design and distribution of debit cards, configuring specific authentication and fraud detection rules or when taking appropriate action to prevent the foreseeable risk of fraud.

The FCA also criticised Tesco Bank for failing to react to the incident with “sufficient rigour, skill and urgency”

As part of efforts to prevent fraudulent transactions, all 136,000 Tesco Bank current account holders had their accounts temporarily frozen, which the FCA report says caused many “embarrassment and inconvenience” when payments weren’t able to be made. Victims of the attack each had their accounts re-instated to the pre-attack balance and some even received compensation.

In the aftermath of the attack, Tesco Bank is now said to have put a “comprehensive programme and significant resources into the issues which made it vulnerable to attack – however, when pressed on what these improvements are, Tesco Bank wouldn’t give details.

While Brazil has been described as a location those behind the attack could be potentially working out of, two years on from the attack there’s still no information on who was behind the attack – and no arrests have been made.

READ MORE ON CYBER CRIME