Tesco Bank suspends payments as 20,000 accounts hit by hackers

Around 20,000 Tesco Bank customers had money taken from their accounts by hackers over the weekend, with double that amount having seen "suspicious transactions".

After some account holders reported as much as £600 had been siphoned from their accounts, Tesco Bank had initially said fewer than 10,000 customers had been affected.

But Tesco Bank chief executive Benny Higgins confirmed on Monday that over the weekend that roughly 40,000 customer current accounts had been "subject to online criminal activity" with half that numbers seeing "money being withdrawn fraudulently".

He added: "That is why, as a precautionary measure, we have taken the decision today to temporarily stop online transactions from current accounts."

Customers will still be able to use their cards for cash withdrawals, chip and pin payments, and bill payments.

Tesco Bank, which said it hoped to refund any losses within 24 working hours but guaranteed all loss as a result of this activity "will be resolved fully", had issued a text alert to account holders late on Saturday after it observed suspicious activity in multiple current accounts and moved to block some customer cards.

Biggest UK bank fraud?

Apart from saying the fraud was committed via "online criminal activity", the bank has not yet given any details of how exactly the fraud was committed.

Professor Alan Woodward, a security consultant who has worked with Europol, told the BBC he thought it might have been the biggest ever cyber attack on a UK bank.

"I've not heard of an attack of this nature and scale on a UK bank where it appears that the bank's central system is the target," he said.

The fraudsters who attacked on Tesco Bank may have found a way to create duplicate cards, the Daily Mail reported, citing claims that some accounts had money withdrawn in Brazil.

“The clever part of the theft from Tesco Bank accounts over the weekend was not the ‘hack’ but doing it over the weekend when banks are typically understaffed, and will respond more slowly,” said Cliff Moyce, of technology consulting firm DataArt, told Computer Weekly.

MP Andrew Tyrie, chairman of the influential treasury committee, said the hack was just the "latest in a long list" of failures of banking IT systems and that he would be writing to Higgins to find out more details and what actions the bank was taking.

“At the beginning of the year, I wrote to the regulators urging them to take action to ensure that banks improve the resilience and security of their systems, and their IT expertise," he said. “Millions of customers remain unnecessarily exposed to the risks of IT failures, including delays in paying bills and an inability to access their own money."

Shares in Tesco, which has owned Tesco Bank outright since 2008, were down as much as 2% in early trade on Monday.