The Financial Conduct Authority (FCA) has fined Tesco Bank 16.4 million after the supermarket giant's financial arm sustained a massive cyber attack in November 2016.
The bank failed to exercise due skill, care and diligence in an attack which saw cyber criminals make way with 2.26 million within a 48 hour period, according to the UK's financial services regulator.
An investigation ruled the attackers most likely used an algorithm to generate authentic Tesco Bank debit card numbers for 'virtual cards', and subsequently used those to engage in thousands of unauthorised transactions. This constituted a breach of the Financial Services and Markets Act 2000.
Deficiencies in Tesco Bank's design of its debit card, financial crime controls, and the team in charge of monitoring financial crime were exploited, with current account holders left vulnerable as a result. No personal data was lost or stolen, however.
"The fine the FCA imposed on Tesco Bank today reflects the fact that the FCA has no tolerance for banks that fail to protect customers from foreseeable risks," its executive director of enforcement and market oversight Mark Steward said.
"In this case, the attack was the subject of a very specific warning that Tesco Bank did not properly address until after the attack started. This was too little, too late. Customers should not have been exposed to the risk at all.
"Banks must ensure that their financial crime systems and the individuals who design and operate them work to substantially reduce the risk of such attacks occurring in the first place."
The 48-hour cyber attack began in the early hours of 5 November 2016, with Tesco Bank's fraud analysis and detection system triggered two hours later at 4:00am.
The system automatically sent text messages to account holders asking them to call about 'suspicious activity' on their accounts. The bank became aware of the attack as a result of these calls, which quickly overwhelmed the fraud prevention helpline as attempts increased.
Although Tesco Bank's controls prevented 80% of the unauthorised transactions, more than 8,000 current accounts were affected. Immediately following the attack, the perpetrators were reported to boast about their crime on the dark web, labelling the bank a "cash milking cow" and "easy to cash out".
"We are very sorry for the impact that this fraud attack had on our customers. Our priority is always the safety and security of our customers' accounts and we fully accept the FCA's notice," said Tesco Bank CEO Gerry Mallon.
"We have significantly enhanced our security measures to ensure that our customers' accounts have the highest levels of protection. I apologise to our customers for the inconvenience caused in 2016."
The FCA found that many customers suffered embarrassment and inconvenience while making payments using their debit cards, while others faced long call queues and did not receive the help they needed from Tesco Bank's call centre. The bank also applied 9,000 in charges and interest, which led to 668 unpaid direct debits on customers' accounts.
Due to Tesco Bank's cooperation with the FCA, as well as significant redress programme which fully compensated those affected, the regulator imposed a significant reduction on the 33,562,400 fine it would have otherwise issued.
