Tesco Bank has halted online payments for current account customers after money was taken from 20,000 accounts.
The bank's chief executive Benny Higgins told the BBC he was "very hopeful" customers would be refunded within 24 hours.
About 40,000 accounts saw suspicious transactions over the weekend, of which half had money taken, he said.
Customers will still be able to use their cards for cash withdrawals, chip and pin payments, and bill payments.
They can also use online banking, but cannot make online transactions until the situation is back under control, Mr Higgins told the BBC's Today programme.
Earlier, the bank confirmed some accounts "have been subject to online criminal activity, in some cases resulting in money being withdrawn fraudulently".
Mr Higgins also apologised for the "worry and inconvenience" that customers have faced.
Customer updates
One cybersecurity expert said this could be an unprecedented breach at a British bank.
"I've not heard of an attack of this nature and scale on a UK bank where it appears that the bank's central system is the target," said Prof Alan Woodward of the University of Surrey.
Over the weekend, customers complained about money being withdrawn without permission, cards being blocked and long delays to get through to the bank on the phone.
"Any financial loss that results from this fraudulent activity will be borne by the bank," Mr Higgins said. "Customers are not at financial risk."
"We continue to work with the authorities and regulators to address the fraud and will keep our customers informed through regular updates on our website, Twitter, and direct communication," he added.
Tesco has yet to use the word "hacking" to describe the breach.
The bank has more than seven million customer accounts and 4,000 staff, based in Edinburgh, Glasgow and Newcastle.
Kevin Smith, from Blackpool, said he had lost £500 from one account and £20 from another.
He said: "I was just about to go to bed when I received a text message from Tesco saying there had been fraud on my account. So of course you panic."
Alan Baxter from Berwick-upon-Tweed said he had lost £600, leaving him with just £21.88 in the bank.
He said: "Tesco said they couldn't offer me emergency funds but would offer £25 as a goodwill gesture.
"I've got food and petrol to pay for. I have a delivery of coal coming tomorrow for our coal-fired heater and I won't be able to pay."
'Money has vanished'
Other customers complained on Tesco Bank's website and through social media about long delays when calling the company's customer service line to find out if their account was affected.
One customer, Mark Noakes, told the BBC: "Looked at my account this morning to find a large hole! There was £2 in there; there should have been a lot more!
"Finally got through to customer services to be told it would take 48 hours to sort as there had been a lot of transactions on my account that could not be linked to me or my wife.
"For such a big company they are not being professional. I'm doing well compared to some others as I have another bank account and this will all get sorted somehow."
Robert Schifreen, editor of the computer safety website Security Smart, said Tesco Bank must tell people what happened and how fraudsters obtained customers' bank details.
"It could be, for example, that people have been attaching skimming devices, card readers and cameras specifically to Tesco's cash point machines, so that they've been capturing people's accounts there," he told the BBC.
"It could be somebody who works at Tesco Bank who's had access to the database. It could be somebody else, who Tesco have passed information to, and that information has been hacked."
Refund rules
British bank customers have had money stolen from their online accounts by criminals before.
Last year the National Crime Agency warned internet users to protect themselves against a strain of malicious software, which had enabled criminals to steal an estimated £20m from UK bank accounts.
The Financial Conduct Authority says banks must refund unauthorised payments immediately, unless they have evidence that the customer was at fault or the payment was more than 13 months ago.
Banks are also required to refund any charges or interest added to your account as a result of the fraudulent payments.
Tesco Bank has been owned by Tesco plc since 2008, after starting as a joint venture with Royal Bank of Scotland.
Shares in Tesco have fallen more than 1% in early trading.
Post A Comment:
0 comments: