> series: anatomy_of_a_breach —— part: 095 —— target: tesco_bank —— stolen: £2,500,000 —— accounts: 9,000 —— fca_fine: £16,400,000<span class="cursor-blink">_</span>_
On the weekend of 5-6 November 2016, Tesco Bank detected a wave of suspicious transactions affecting its current account customers. Approximately 9,000 accounts were targeted, with around £2.5 million successfully stolen through fraudulent debit card transactions. Tesco Bank took the unprecedented step of suspending all online card transactions for its 136,000 current account holders — the first time a UK bank had been forced to halt online transactions due to a cyber attack.
The FCA's investigation revealed that attackers had exploited weaknesses in Tesco Bank's design of its debit card system, including the algorithm used to generate card numbers and the authentication controls on card transactions. The FCA fined Tesco Bank £16.4 million — finding that the bank had failed to exercise due skill, care, and diligence in protecting its personal current account holders from a 'largely avoidable' attack. Tesco Bank refunded all affected customers in full.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallPrevious major payment fraud events in the UK — and internationally — had targeted payment processors, retailers, and credit card systems. The Tesco Bank attack was different: it targeted current account debit cards directly, draining money from customers' bank accounts rather than compromising cards at the point of sale. For UK consumers, the attack struck at the heart of banking trust — the expectation that money in a current account is safe.
The Tesco Bank fine established that the FCA considers cyber security failures to be failures of 'due skill, care and diligence' — the same standard applied to other operational failures. For FCA-regulated firms, this means that cyber security is not an IT issue but a regulatory compliance obligation that the board must own.
Our PCI DSS penetration testing assesses payment card system security. Infrastructure testing validates fraud detection and transaction monitoring controls. Cyber Essentials certification provides evidence of baseline security. SOC in a Box for Financial Services provides the continuous monitoring the FCA expects. And UK Cyber Defence provides the incident response capability that turns an attack into a managed event rather than a £16.4 million fine.
Our <a href="/penetration-testing/pci-dss">PCI DSS testing</a> assesses payment system security. <a href="/cyber-essentials">Cyber Essentials</a> certifies baseline controls. <a href="https://www.socinabox.co.uk/sectors/ifas-wealth-managers">SOC in a Box</a> monitors 24/7.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call