/ Money, Shopping

Tesco Clubcard fraud: have you been affected?

Tesco clubcard

Loyalty card points gained at shops and supermarkets can be a great way to spend and save for specific purchases and special occasions. But what would you do if your hard-earned rewards were suddenly taken from you?

Well, that is what some Tesco Clubcard holders have said has happened to them this year, meaning they missed out on well-deserved rewards.

Loyalty card points have become a big part of many people’s shopping routine. While they are essentially a bonus, the rising cost of living has resulted in plenty of people becoming increasingly reliant on the rewards.

Every little helps

At the beginning of the year, Tesco called in the police over claims that some customers had fallen victim to online fraudsters who had hacked into their Clubcard accounts and taken hundreds of pounds worth of vouchers.

However, it doesn’t seem to be a problem that has gone away, with people still posting on online forums about the matter.

In a recent post on MoneySavingExpert.com, one user describes how points disappeared from their account:

‘I went on the Clubcard section [of the website] to see how much we had saved. We build them up all year to exchange at Christmas. I discovered there was only £2 there. All our others (about £52 worth) had been redeemed under Clubcard Boost, all on the same date, about three days before I discovered my login for groceries wasn’t working.’

Checkout your Clubcard account

It’s worth checking your online account and changing your password if you believe you’ve been affected. And if you have become a victim, tell Tesco and contact Action Fraud.

Have you lost out on a loyalty scheme in the past or been affected by the fraud? How much did you lose and were you able to get your points/vouchers back? We’re keen to find out how many people are affected by the issue.

Comments
Annette says:
19 October 2013

I had no idea that this was happening. Just by chance I went onto my account and I have discovered that my points have been used by someone calling themselves Hakim Sheikh, living somewhere in the London Area. My points have been used at Lea Valley and Tottenham stores in London. I live in Lancashire and have only been to London once in my life and that was about 5 years ago. There is nothing on the website to warn that this has been happening. It amounts to over £50 worth of points that I was saving up for Christmas. My husband and I are retired and in poor health and this has come as a real shock to me.

su123 says:
9 November 2013

I had £74 worth stolen and used at Wellingborough and Northampton stores. I live in Scotland !I told Tesco and they immediately re reimbursed me.

Rosemary says:
9 November 2013

Your very lucky, I’ve posted about mine on facebook, a tesco adviser said they would reimburse me, and asked how I had planned to spend them, I replied, then another adviser said there was no way I would get them until February!! I’m going to write to Tescos and tell as many websites etc about this fraud that is rife, and Tescos are keeping quiet about it.

my Tesco clubcard account was hacked. and Tesco not telling anyone about this going on still .. this is awful 17/11/2013

Rosemary says:
25 November 2013

This is getting serious now, I have spent another hour today on the phone keep getting past round in circles, Tescos have given me back my points won’t get them now until February, I ordered 3 magazine subsrciptions, then someboby ordered me another 3 as they said it should have gone by now! Then spoke to somebody else who said ordering magazines now takes a week to get the email, Now I see 5700 have been deducted from my account the magazines come to £30.50.
Do you know anybody else senior at tescos that I can talk to please.

Sally says:
29 October 2013

I had no idea this was happening either, till last night. I was going to use my clubcard vouchers to purchase Christmas presents for my children, nieces, nephews and friends. I have been saving my rewards for the ‘boost on toys’ at Tesco which started yesterday. I filled my shopping basket at Tesco Direct and went to the checkout and there weren’t enough vouchers. £206.50 worth of my vouchers had been spent in 3 different Tesco stores on 2/10/13! Tesco will kindly reimburse the vouchers but I won’t get them till the next round of vouchers goes out in February! That is good news but now I can’t get all the toys I need for Christmas!

kaye says:
31 October 2013

This has just happened to me too. I discovered today that around £80 of my club card vouchers had been spent in Leicester in September. When I rang tesco they made me feel that I was to blame and kept insisting that I must have let someone use my card. They said they would pass it on to their fraud dept but it could take weeks. I rang action fraud but was disappointed to hear that they don’t investigate every case. Reading that this has happened to other people has given me some hope that I might get my vouchers back although I doubt this would happen in time to take advantage of the club card boost which was my intention. I will be back on the phone to tesco tomorrow insisting that they take this more seriously.

Annette says:
31 October 2013

My advice is to go on Tesco’s Facebook page and add a comment. This does make them take more notice. It is NOT your fault, I have had so many people now contact me to say they have had this happen to them. Tesco are not taking it seriously enough.

Tesco will no doubt tell you to message them privately and they will offer you a refund of your points. Tell them that you want them for Christmas and they may offer to help out with that.

Don’t let them bully you, they try it on. I don’t know how this has happened but I do know we cannot be to blame. I have separate passwords for each of my online accounts so there is no way they could have got my password. The other worrying thing is that someone will have changed the name on your account. I received my latest batch of vouchers in the fraudster’s name which, as I had just come from a hospital appointment I found very upsetting.

I have emailed Watchdog twice but so far have had no response.

The least Tesco could do is to warn customers that this fraud is a possibility, they are not even doing that. Best of luck.

Rosemary says:
5 November 2013

Been trying to get onto my Clubcard account, to order a magazine subscription, since Sunday, first of all it said my email address(the only one I have ever had) was not recognised, I have used the clubcard site for many years, I phoned yesterday they said they would change my email as it was wrong on the account, and to wait 24hours for it to go through! Still couldn’t get on it today, 7 phones calls later, yes my account has been hacked and vouchers all spent, they said they would credit my account, but it wouldn’t be until after christmas now, surely something should be done about this, as reading about it now online its rife. I am so dissappointed with Tesco for their staffs nonchalant reaction. When I asked are they trying to find out who is doing this their reply was, well you can go to the police if you like. I am so cross.

Annette says:
5 November 2013

I know exactly how you feel. It is very distressing, Tesco are not taking this into account when dealing with customers. My advice is to go on their Facebook page to warn other people that this is happening as Tesco are still not warning people. Also report this on Fraud Line at: http://www.actionfraud.police.uk. Tesco did report this fraud to the police earlier this year, that’s how long its been going on but apart from that and giving customers their vouchers back they are doing absolutely nothing as far as I can see. As I have said before, I have now stopped shopping at Tesco because I don’t trust them with my information. It must be costing Tesco a fortune now as there are so many cases. Dozen’s of people have got in touch with me some have lost around £200 in vouchers they were hoping to use for Christmas.

Roy Unsworth says:
10 November 2013

On 28th August 2013 whilst checking my Tesco Clubcard statement I discovered that my balance of £293.00 (I was saving towards a holiday) had been en-cashed on Sunday 25th August 2013 at the Tesco Extra Store Warrington, a location approximately 150 miles from where I live and a town I have never visited.

I contacted Tesco immediately and was informed that the vouchers would be replaced with my November 2013 statement, which they were. I also logged the incident online with the police action fraud website.

At the time of the incident, when I logged onto my Tesco account it would not accept my password and invited me to provide a replacement. This I did, with the only security question asked of me being to confirm my postcode. I was then able to submit a new password and access my account, to then discover the balance of £293.00 had been stolen.

I have since established that from your Tesco Clubcard online account it is possible to print-off replacement Tesco Clubcard Vouchers (on the assumption I assume that you have lost the originals) and that these print-off vouchers may be presented as payment in a Tesco store with no validation (either visual or electronic) to your Tesco Clubcard. Also, Tesco do not as a most basic measure send you an email or text message confirming that replacement vouchers have been provided and thereby provide the opportunity, in the case of fraud, for them to be nullified.

It is my opinion that in my case the thief had somehow discovered my email address and password (which could have been obtained by my accessing my email account from any remote location offering internet access) and with this information and my postcode readily hack the Tesco system by simply logging-on with my email address and then change my password (hence the reason I could not access my account with my original password when I first discovered the theft). This has led me to conclude that the Tesco Clubcard Voucher security system in place at the time was wantonly and blatantly inadequate.

This is the first time I have ever been a victim of theft and it has really knocked my confidence in corporate organisations such as Tesco, which it would appear place profit before customer care. How much more would it have cost Tesco to put a security system in place that was worthy of the name and at the very least to have emailed their customers of the hacking problem as soon as they became aware there was an issue. The bottom line, I assume, is that Tesco as an organisation has made a “business decision” to only adopt an appropriate security system when it becomes “cost effective” to do so, and in the meantime are content to reimburse affected customers who report their loss to them.

Annette says:
10 November 2013

You are absolutely correct, Ray. This is how the fraud is being perpetrated. Tesco are still not doing anything to warn customers of this possible fraud or to email them when the name on their account has been closed. It does make you wonder how much information is being stolen from Tesco accounts and what the long-term implications are. For example, they now have your address and possibly your date of birth (I did not fill in mine).

I am still of the view that Tesco systems are at fault (Tesco deny this) because this has been so widespread across the country. I live in Lancashire, my clubcard was used in three stores in London. I have only been to London once, that was about five years ago for a conference, I wasn’t doing any shopping there. When I first complained Tesco replied that I must have used the vouchers as my clubcard had been presented on each occasion. They clearly don’t understand how their own systems work.

Tesco still have not explained how these fraudsters have gained access to our accounts. They are of the view that we are at fault for using the same password for all accounts. This is not true in my case, I did not use my Tesco password for any other account which leaves me with the view that it is Tesco’s system which is at fault. As I have said previously, it is very easy to blame the customer.

Replacing all these vouchers must be costing more than the cost of replacing their outdated “security” systems. The fraud is still going on – I receive numerous Tweets and messages every week all saying the same and all receiving the same response from Tesco – “its your own fault”.

I have now stopped shopping at Tesco after being a customer for over forty years – I don’t trust them to keep my information secure. Heaven alone knows what they are doing with my debit card details!

Fed up customer says:
11 November 2013

I have been trying to use my £250 of saved vouchers to buy my kids Christmas presents and after a few phonecalls back & forth I have found out that they have been spent by someone else. Tesco have refused to do anything apart from pass it onto their fraud dept which could take weeks. I have had my credit card accessed & used fraudulently twice, and the last time I was sent a new card Tesco somehow linked the clubcard element of my new card to a random bloke so I was sent vouchers to my address but under someone elses name. They told me I must know him (I didn’t) but did change the name back on the account after I wrote a stroppy letter. Now, strangely, my vouchers have disappeared. My husband and I have a secure password safe, different log ons for different accounts and are very savvy about security. I have increasing concerns about the way Tesco seem to handle our financial and personal details. It is extremely unsettling.

Annette says:
11 November 2013

Hi
Have you reported this yourself on Fraud line yet? I think you should do, this is more serious than just having vouchers stolen. Tesco are just not taking this seriously, they seem to be hiding from their customers in the hope that the whole thing goes away. I honestly believe that Tesco’s systems are being hacked but they won’t accept this or accept responsibility for what is going on.

I also went on Tesco’s Facebook page and left several comments to warn other people. I have stopped shopping at Tesco because I am so concerned about the lack of security and their refusal to take enough action either against the fraudsters or to put in place new systems to prevent this happening again.

The number of people being affected by these frauds is still going up which is a clear indication that Tesco are not doing enough to prevent it.

Samantha Warren says:
19 November 2013

I discovered only yesterday that my account had been hacked. Whoever did it got the benefit of £57.50 worth of my vouchers. I’ve changed my password now as I was not even aware that this was a problem. Why haven’t Tesco emailed their customers to make us aware of such a problem. I had been saving my vouchers for Christmas and was initially told I would have to wait until Feb 2014 to be reimbursed which is ludicrous! They have now agreed to issue a gift card on the account.

Samantha Warren says:
22 December 2013

* UPDATE *

I’ve finally received my £60 gift card that was promised weeks ago, accompanied with another £60 giftcard as a ‘gesture of goodwill’ for the number of complaints that I had to make to Tesco!!!

Rosemary says:
19 November 2013

Samantha, now you have lost out, accepting a gift card, which is only to the value of the vouchers, where as in store you can double up on boost, some offers are worth triple , magazine subscriptions etc, I’m still having problems with tescos over my points, I want to order 3 Magazines from the points they put back ready for February, made endless phone still nothing has happened, they just keep passing me round in circles, I’m not going to give up, also shall be writing to them telling them about their terrible service.

claire says:
25 November 2013

Someone hacked into numerous customer Tesco clubcard accounts and used my vouchers (and many other customers). I have reported this to the fraud team and have a crime reference number – why then are Tesco refusing to give my clubcard vouchers back and why are they making this situation so difficult (I have made numerous telephone calls to Tesco, and been assured on 3 occasions my £300 of clubcard vouchers would be returned). However, today I have been informed that they would not be returned and to write a complaint. This hacking has been happening since March and is still continuing. Poor, poor management Tesco

Annette says:
25 November 2013

Hi Claire
Have you looked at your clubcard account online and can you identify where these vouchers were used? This is the first time I have heard of Tesco not refunding vouchers. Let me know what is on your account.

claire says:
25 November 2013

Hi Annette, yes I looked online but the hacker boosted all of my vouchers £312 worth (which id saved for well over a year), changed my name to his and my email to his (I gave the fraud team this info) – so the voucher amounts just say boosted and no other information. I have put it on Tesco facebook so hopefully someone at Tesco who doesnt want the publicity may look into it – I intend updating this daily until someone intervenes at Tesco – during the last telephone call to Tesco they said I had spent the boosted vouchers (I didnt even know boosted scheme was in place !!) but could not tell me where they had been spent? So I have formally complained via email. Their customer service is really appalling – I am amazed and so disappointed in Tesco

Rosemary says:
25 November 2013

I put about mine on facebook, had a couple of conversations via facebook with customer services then mysteriously all the conversations dissappeared, so good luck .

Annette says:
25 November 2013

Print out all the information that you do have on the account page because they will wipe it and then your evidence is gone. By saying that you have used the vouchers they are accusing you of attempted fraud which is a criminal offence. I pointed this out to them. Their customer service is virtually non-existent. They are still not warning customers or shop staff of what is happening. I have been contacted by loads of people on facebook and on twitter.

They have set a president by refunding other customers, keep on at them until you get yours refunded, you are entitled to that. I don’t believe for one minute that this is the fault of customers which is what Tesco are saying.

I have also contacted Watchdog but have so far had no response. We might get one if other people do the same.

Michelle Harris says:
28 November 2013

I logged on to find that the account seemed to not be mine, also my vouchers had gone. I phoned and after going around in circles, the operator realised that I had been hacked and all the vouchers spent miles from where I live from downloaded vouchers, without presenting the card on the same day. They have said they will refund and if I want to boost or spend for Christmas, I should phone again and they would do their best. £123 had been spent.

I’ve also had my vouchers stolen (value £73.50). Spent in Birmingham. The suggestion that this is happening through insecure passwords and phishing attacks (fake Tesco emails) is nonsense. I am a Director of IT, I never respond to phishing emails and my Tesco password is strong and unique to the Tesco site.

This is a major breach of Tesco online security in my opinion, which is really serious given that the same password is used for other Tesco online services. I have reported to the police via Action Fraud, but that only gets me a crime reference number and adds to crime stats.

I have also been in contact with Tesco customer services, who have promised and failed (twice now) to refund points and to ensure that I don’t miss out on Christmas boost and other offers.

I would also suggest that everyone also complains to the Information Commissioners Office, because Tesco are almost certainly in breach of the Data Protection Act, because they haven’t taken sufficient care of our personal data, which has resulted in its loss and they have not acted to inform us of the loss of our personal data.

Mike says:
6 December 2013

Following up on my previous post. Tesco customer services initially promised to reinstate my vouchers within 24 hours, but nothing happened. We phoned back and escalated to a manager, who was very good and promised a reinstatement with 24 – 48 hours. He didn’t quite manage it, but at least phoned me back to assure me that he was on the case – it actually took 4 days to get the vouchers back as boosted ones for finest wines. Unfortunately, we had missed the buy 6 or more bottles and get 25% off, so we phoned the specific manager back and he is sending us a gift card for the amount we missed out on. Overall, very good recovery and service on Tesco’s part.

I also complained to Tesco about the loss in the first place and got this reply:

“Thank you for taking the time to email us, I really appreciate it.

I’m sorry that you were a victim of our recent wide scale fraud, I can understand how worrying this must be for you.
Please let me assure you that we work very hard to make sure that the service we offer our customers is the best possible.

We don’t know how these fraudsters have managed to access customers accounts and it is still under investigation by the police.

Can I ask have you contacted Action Fraud? As they are dealing with the Police regarding this.

If you haven’t contacted them can I ask you to this, there contact details are 0300 123 2040 or http://www.actionfraud.police.uk.

If you have any further queries please don’t hesitate to contact us again.”

I notice that the Clubcard site now sends confirmation emails when account details have been updated, which at least shows progress and should help.

Caroline says:
14 December 2013

Mine didn’t!

Annette says:
30 November 2013

Hi Mike
I also use a password unique to Tesco and never respond to phishing emails. Tesco didn’t believe me when I told them this. Their response, at first, was that I had used the vouchers In three different London stores although I live in Lancashire and never go to London. They then tried to say that someone must have hacked into my account using an insecure password. I tried to point out that I used a unique password which was a random mix of letters and numbers known only to me but that seemed beyond their understanding.

It took three days for the points to reappear on my account but of course these cannot be used until February.

Why would a company refund vouchers (which must now run into a considerable amount of money) if the customers were at fault as they suggest? It is my belief that they have had a security breach and are trying to play it down. They have made no attempt to warn customers that this is happening, nor do they tell customers when their accounts have been accessed and their details changed. I don’t work in IT as you do, but surely this is standard procedure?

What I don’t understand is how this can be happening right across the country. I have been contacted by people from the South East, the Midlands, Wales and the North West. The vouchers have all been used many miles from where the account holder lives. Worryingly one woman reported that her Tesco credit card has also been used.

I will look at reporting to the Information Commissioner’s Office as nothing else seems to be having any affect. Tesco are completely disregarding any customer concerns whilst saying that they take the matter extremely seriously.

YankyeeAlpha says:
5 December 2013

It could be an authorised operation from Tesco’s high up to clear clubcard points from customers.

Reasons:
1) They are losing market share lately
2) They know customer don’t check the club card accounts regularly.
3) They are using clubcard accounts points to send out genuine Tesco Direct orders good
4) When you reported it, they delete all the traces of fraudulent spending of club card to avoid traces.
5) They are not interested to report this to police and agreed to refund the lost voucher straight away.
6) I am on Christmas saver, the attacker seem to know when to clear out the voucher.
7) The attacker tried to make it a genuine order by placing unauthorised items to my home using a portion of clubcard voucher. Not sure where the rest has gone.
8) Main concern, it seems someone was able to steal / hack to obtain clubcard number, account username & password, to clear clubcard voucher. The last time I used my clubcard voucher was last year.

Johny says:
1 December 2013

There is certainly more to this than we are being told, noticed ours have been swiped a few days ago.

If Tesco had a feature to send an email to the old address in the event of an email address update, at least we would have known there was something going on.

I’m told goods were bought online, but I still can’t get into my account to see what address they they were shipped to and I’m being told by Tesco just to create another account.

Annette says:
1 December 2013

It just beggars belief, fancy telling you to create another account, as if that will sort out the problem. I don’t understand why Tesco cannot access your account to find out what has happened to your points and where the goods were sent. Surely if they did that they could point the police in the right direction and there might at least be one arrest. They are behaving as if this isn’t a criminal offence which it most certainly is. It does make you wonder how safe any of our information is in the hands of Tesco which is why I no longer shop there.

Alison says:
2 December 2013

I also have had my clubcard account cleared out. I first noticed that I had an meal confirming that I had converted some of my vouchers into a boost – no I hadn’t! I spoke to Tesco and they were very good and said that they would reimburse the vouchers. I then changed the password Then 2 weeks later my husband was checking the account and they had wiped out about £200 worth! Looking at the info, they had printed off the vouchers and used them instore in west London – I live on Surrey/Hampshire border. At the moment their fraud department is looking into it. Have to admit that the lady on the phone was very good and at no point accused me of anything. Will have to see what happens next.

YankeeAlpha says:
4 December 2013

My Tesco Clubcard was hacked on 30th Nov. I have no idea why the account was hacked. I received a Tesco Direct order on 3rd Dec, this was not something I ordered myself. My first instinct told me my account has been hacked.

Guess what, the Clubcard details has completely changed including my email address. My attacker changed the email address on 30th Nov, but it was already too late. The attacker took £150 voucher from me.

I have never clicked on any phishing email myself, and never used my clubcard on another computer, I always keep my computer up to date. I really have not got a clue how it was done.

YankeeAlpha says:
4 December 2013

I reckon it has to be an inside job. Tesco introduced a new procedure this Autumn requiring to enter 3 digits of the clubcard to get access to the voucher. I have never reveal this club card number to any one and I have not touched my club card account for almost 3 months.

How was it possible to obtain my clubcard number?