/ Money, Shopping

Tesco Clubcard fraud: have you been affected?

Tesco clubcard

Loyalty card points gained at shops and supermarkets can be a great way to spend and save for specific purchases and special occasions. But what would you do if your hard-earned rewards were suddenly taken from you?

Well, that is what some Tesco Clubcard holders have said has happened to them this year, meaning they missed out on well-deserved rewards.

Loyalty card points have become a big part of many people’s shopping routine. While they are essentially a bonus, the rising cost of living has resulted in plenty of people becoming increasingly reliant on the rewards.

Every little helps

At the beginning of the year, Tesco called in the police over claims that some customers had fallen victim to online fraudsters who had hacked into their Clubcard accounts and taken hundreds of pounds worth of vouchers.

However, it doesn’t seem to be a problem that has gone away, with people still posting on online forums about the matter.

In a recent post on MoneySavingExpert.com, one user describes how points disappeared from their account:

‘I went on the Clubcard section [of the website] to see how much we had saved. We build them up all year to exchange at Christmas. I discovered there was only £2 there. All our others (about £52 worth) had been redeemed under Clubcard Boost, all on the same date, about three days before I discovered my login for groceries wasn’t working.’

Checkout your Clubcard account

It’s worth checking your online account and changing your password if you believe you’ve been affected. And if you have become a victim, tell Tesco and contact Action Fraud.

Have you lost out on a loyalty scheme in the past or been affected by the fraud? How much did you lose and were you able to get your points/vouchers back? We’re keen to find out how many people are affected by the issue.

Comments
Annette says:
4 December 2013

Nor has anyone else, except that there are theories that it could be an inside job or that Tesco’s own systems are insecure. Tesco deny this but for this to have happened to so many people in so many different locations. Also given that the vouchers have been spent in different areas of the country this has to be more than customer error. I was speaking to a staff member from Tesco yesterday. Staff have still not been told that this is happening. She said that she’d had a number of people presenting vouchers which had already been used but still no one told her that there was a problem.

Tesco have a lot of questions to answer but they still don’t want to answer them honestly. They will say they are taking the matter seriously. If they were they would have taken steps to ensure this stopped happening.

Tesco gain a lot of very valuable information about us and our spending habits from our Clubcards, if we were all to stop using them they would have problems as they are so reliant on these systems. However, in my view they are not keeping this information secure and therefore should not be allowed access to it. By continuing to use Clubcards when the systems are obviously being hacked by whatever means we leave ourselves open to identity fraud.

Similar story here, I was first alerted to something not quite right when I got a mailing of coupons addressed to a Mr M Ahmed at my address and no one of that name lives here or is associated with me. I then tried to login to my clubcard account to find it didn’t recognise my details. I phoned customer services and she made out it was human error on my account but when she said I had no vouchers associated with my account and I know I had £54 there and still have the paper vouchers I knew there was something wrong. As soon as I said fraud, her whole attitude changed and she became very aggressive suggesting that it was my fault and when I asked what they would do I was told ‘ there is a lot of fraudulent activity around these days’ as if that excused it. She eventually said it would be investigated, refused to give me a time scale and I still can’t access my account. Seriously thinking of getting rid of my Tesco credit card as well and shopping elsewhere. They don’t value customer loyalty and as for customer service don’t make me laugh!

Annette says:
6 December 2013

Hi Jan, your experience is fairly typical of Tesco’s attitude towards their customers. I have had one person who had their credit card accessed as well which is even more worrying. I have found that posting messages on their facebook page usually has the desired effect in terms of making them take notice. As I have said previously, what worries me the most is that other people have access to our personal details which we are all warned to guard.

I have never had an experience like this, most companies will warn you if they feel your account is at risk (even if it isn’t) Tesco don’t they hide behind customer blame and are still refusing to acknowledge that the problem is theirs or warn their customers.

Michelle Harris says:
6 December 2013

I checked and my points have been added to my account. It wasn’t particularly quick, but at least it was done.

Debz says:
7 December 2013

My clubcard vouchers have been wiped out totally, I called Tesco on Thursday about this as my vouchers were used in rainham in essex ! ( I don’t live any where near essex!)and at that time I had 16.50 still left in my vouchers.
I had changed my password, but did not receive a confirmation email, strange.
Today I checked my account to find that the rest of my vouchers have been used, so I changed my email address and received a confirmation email about that.
I then eventually changed my password after about 10 attempts but have had no email to confirm that which is a bit worrying.
Have emailed Tesco and about to visit their facebook page now.

Mr Ahmed seems to be a popular name lol ….my account was hacked in May and my details changed to Mr A Ahmed and my vouchers spent instore 100’s miles away over 2 days

i thought the extra security check would have cut this fraud down but apparently not

Tracy Hendry says:
9 December 2013

Two weeks ago I discovered that £10 out of my vouchers had been spent in June 2013. I only phoned them by chance as I could not use my scan and shop card in a Scottish Tesco Branch. My points had been spent in a Tesco in London. I have also received mailing to my home address for a Mrs N Acman who I know has never lived here as it is a new build house. The last 4 digits on the mail that I receive is the same account number that I have for my Tesco Clubcard Account.(Have they cloned cards). Having phoned Tesco over the last 2 weeks four or 5 times I have still not had them reimbursed but they did advise me to report it to the Action fraud website which I have. They admit no wrong doing over the phone but do admit they think someone has accessed my account and stolen it that way but I know that I never give away any passwords or click on any links that appear fraudulent. This is a violation and actually very upsetting yet Tesco seem to be doing nothing.

Annette says:
9 December 2013

Hi Tracy
It is very upsetting which is something Tesco fail to realise. When I received my November vouchers in the name of Mr Hakim Sheikh I felt really sick and upset about it. It was almost like he had got into my home.

What this person (or people) is doing is to hack into the clubcard account change the name on the account,, print themselves a temporary clubcard (which you can do on the site) and then print out the vouchers.

We have done nothing wrong. Tesco is in the wrong for (a) not putting any new systems in place to prevent this fraud, (b) not warning that this is happening and to be aware of it. Even their own staff are unaware of the fraud. What kind of company doesn’t warn both customers and staff of what is going on. This has gone on for over a year and still goes on, it beggars belief that they are still letting it happen. They have their heads well below the parapet and still blame customers.

You are quite correct – Tesco are doing nothing. My advice is to go onto their Facebook page and make a fuss about it. You will get a response (probably privately by email) and you will get your points reimbursed.

You might take comfort in the fact that there are hundreds of people out there who have had the same thing happen to them. I will never accept that this is our fault, it is far too widespread for that. Either its an inside job or there is a massive hole in Tesco’s security systems.

Michelle Harris says:
9 December 2013

I hardly ever log on to clubcard points, don’t share passwords etc . And I also found it upsetting and an insult to be sent vouchers to mr Hanson, the hacker alias of our account. I think it sad that Tesco just ignores this is happening!

Janet says:
10 December 2013

I also had my vouchers stolen a few weeks ago, but luckily, and quite by chance, noticed as soon as some were spent. Tesco replaced the points and told me to change my password as I had been hacked. I did so immediately and also used the rest of my vouchers before the thief could. However I know of two other people who have had their vouchers stolen who did not have online accounts and never use computers. So I cannot see how any hacking into accounts can be down to the account holders having insecure passwords or having responded to phishing emails.

Annette says:
10 December 2013

I find your last point very interesting I did wonder if people who do not have online account had lost vouchers. Sounds more and more like an inside job

Janet says:
11 December 2013

It is only my opinion, but I feel that Tesco may have kept quiet about this because they were afraid of customers who had used their vouchers pretending that they hadn’t and claiming replacements which would therefore cost them even more. In which case they would obviously prefer us to take the risk rather than them.

I am sure that there must be many customers, unaware of this problem, when told that their vouchers had already been spent would assume that they had made a mistake and accept it.

Caroline says:
14 December 2013

My tesco account has been hacked today. They have ordered items from tesco direct to be sent to a different name and address. I received an email telling me this. I immediately phoned tesco, thinking that they could cancel the order preventing the fraudster receiving the goods. The staff at tesco wouldn’t speak to me about it because the name on the account didn’t match what I was telling them, my details. I enquired if the name and address was that of the fraudster – was told it was but that they couldn’t speak to me as they would be breaching the data protection act! Ok Ill change the details online, I logged in having had to change the password. No, sorry they still wouldn’t talk to me about it as they still couldn’t be sure it was my account. I would have to email them and could I send them a photo of my clubcard with my name and number on! This was from the supervisor, he was completely unwilling to help in any way. I asked if tesco had a fraud team, could I speak to them. He gave me a telephone number which was actually the action fraud number. I have emailed tesco. I have spent an hour on the phone, I have lost £150 of clubcard vouchers and someone has a hudl winging their way to them. Great customer service tesco.

Annette says:
14 December 2013

OMG this is the worst so far. How can Tesco expect loyal customers to stay with them when they treat them like this. The situation gets worse and worse and no one is doing anything about it now. Hiding behind the data protection act is disgusting. they will be fully aware that that is your account from the records that they hold. They will know that the account name and address has been changed. Go back into your account and print out everything that is there before they have chance to wipe it off, that will be your evidence of what has happened. I suggest you go onto their facebook page and make a big noise about what has happened to you. They don’t like the bad publicity to get out. Best of luck with this, I hope you get some sort of satisfaction. Let us all know what happens.

I recently realised that I had some Tesco vouchers that had just expired. They were still accepted and I saved £14.50. I do wish that Tesco would just give us lower prices.

In the article above, the post on Money Saving Expert is mine. After further investigation it turned out it was £55 of points stolen not £52. They were redeemed for Thorpe Park tickets.

The service I have received so far has been an utter joke, bear with me, this will take a while…

Initially I was accused of spending them myself despite living over 4 hours from Thorpe Park. They than accused me of falling for a phishing email, which is not the case as I’m a computer geek who knows better than to click a link in an email. So after some talking they agreed to return my points on my November statement so I could double up and use them for Christmas as planned.

November came and no points were put back. So I rang up and spoke to a gentleman who apologised and told me he could do it manually but it would take 48 hours to show. 48 hours later and still no points put back.

I rang back and spoke to another gentleman who apologised, said he could see it should of happened but hadn’t. He said he would escalate it to his manager who would call me back. He said it may be a £55 gift card instead. I told him that was no good as I couldn’t double that in the Christmas boost. He said he’d sort it to be £110 and that someone would get back to me.

A few days later and nothing, no call, no card, no points. Rang again and got another apology and a promise that a £110 card was being processed right now and I can expect it in 7-10 days.

10 days later and nothing. Sick of explaining the entire story from scratch on the phone I decide to email in. I receive a reply the next day apologising in full but stating the card was now being processed and will definitely be with me in 7-10 days.

10 days later and guess what? Nothing again. So I email in again referencing the previous email and the name of the lady who had sent it. I get a call back quite quickly off a gentleman full of apologies saying they had taken down my clubcard number wrong so the money card had not yet been issued. He said they had the correct info now and would process a card straight away, that his colleague ‘Maradonna’ (not sure if he was taking the mick) in another office was sorting it for me and that unfortunately it would be 7-10 days.

Yesterday was 10 days and nothing again. I emailed in agai and also, contacted the Tesco Clubcard twitter account. The twitter person for Tesco apologised and took some info. Around 7pm last night a lady from Tesco rang saying she could see a card has been sent 11 days ago and I should have it. I told her there was definitely no card. She then said something about it being off that they keep sending cards that don’t arrive so I pointed out that on all other occasions Tesco have admitted to NOT sending the cards, they weren’t lost, Tesco said they hadn’t done it. She promised to look into it and ring me back at 12pm today. That call hadn’t come by 3pm. The twitter account contacted me to verify some info. I told them about the call and not receiving the promised call back. With 5 minutes I had a voicemail from the same lady as last night saying this had to be investigated further by her colleague (the same lady who sent the first email). No number was left to call her back and no name.

So I contacted the twitter account again who looked into it and noticed that just over a week ago £34.50 of points were put back, this is after 3 promises of a £110 card being on it’s way. Not only is 35.50 just over half of what I’m owed, those points cannot be used until the next statement in Feb. these points were saved for the Xmas boost. My wife was made redundant recently and we were relying on those points to finish off the kids Christmas shopping. It’s now Dec 14th and time is running out.

Does anyone have any advice here? Is it worth emailing the CEO or even watchdog? It’s an absolute joke and a complete disgrace. I feel like Tesco are just telling me lies over and over again. It’s their responsibility to protect their customers details and it has been compromised.

I worked out we spend around 20% of our household income with this company through groceries, petrol and insurance and I feel like they are just sticking two fingers up to us.

Caroline says:
14 December 2013

The Facebook tesco staff seem to be more efficient. They tell me that they have stopped the delivery of the hudl ordered fraudulently on my account – this is a step forward from any of the staff that I have spoken to in the phone. I was told that my vouchers would be restored within 24 hours – I will update you tomorrow!

Annette says:
14 December 2013

I’m glad about that Caroline. Mind you from what I have heard there is a great deal of difficulty getting the Hudl so it may not have been in stock anyway. You will no doubt get the vouchers back but it could take 48 hours or more. You won’t be able to use them until February. They definitely take more notice on Facebook because its out there for all to see. The whole situation is ridiculous though. Latest thoughts are that this is an inside job because it is so widespread.

pow$wf says:
14 December 2013

I had the same problem but the the stolen vouchers were reimbursed almost immediately. I feel for the rest of you though and would like to help.I have shares in Tesco..not a lot, but is there anything you could suggest shareholders could do to get answers to this huge problem?

Annette says:
14 December 2013

Gosh there are lots of things. Like first of all accepting that this is happening and warning staff and customers. Stop patronising us by saying they are concerned when they don’t really appear to be bothered. Next tell us what they are doing to stop the same thing happening to our next lot of vouchers in February. Stop blaming customers for having insecure accounts and passwords when even customers who don’t use online accounts have been affected. I could go on and on.

I’ve been promised very clearly in emails from them that they will provide a money card instead of the points. After 3 months of back and forth and the last 5 weeks of failure to send this card I am absolutely insistent that they fulfil this promise. Points for February is not acceptable. I don’t know what is causing so much trouble for them. They’ve agreed to the card so surely they can get a store local to me to provide this… Or even provide several discount codes to cover this for when I shop online with them. We had an issue a while back with a delivery and they instantly emailed us a £10 discount code. I don’t care if they send me 11 of them, it will all be spent back online anyway.

Rosemary says:
14 December 2013

I had the email below on the 4th December, but didn’t reply incase it was dodgy, and I had written in person to the CEO of Tesco and to be fair to him thought I would wait for his answers, got the two page letter back, still saying this all happened earlier this year, just one paragraph is saying”We know that many people use the same email address and password combinations on a number of different websites, and our investigations suggested this may be the problem,” are they in denial or what. I have also contacted watchdog but this programme has finished for now, so Patrick the conversation editor of Which I would like to be contacted, just so I can read you this letter.

Hello and thank you for commenting on Which? Conversation.

You shared your experience of Tesco Clubcard points going missing. We have had a request from Channel 4 for case studies to appear in a documentary on the issue, and we wondered whether you might be interested?

If you are interested in being interviewed, please reply to this email with the phone number you’d like to be contacted on, the best time to contact you and where you are in the country.

Kind regards,

Patrick

Conversation Editor

Which?

http://www.whichconversation.co.uk
http://twitter.com/WhichConvo

I had a similar thing suggested to me by the customer service team, that people use the same passwords over multiple sites. This is a nonsense excuse by Tesco, for a start the password on Tesco is a 9 character limit, so I know for certain that the password on my account is unique to that site from all other sites I use where I tend to use a variation of the same password which has 12-14 characters depending on the one I decide to use.

Furthermore, this password I use is a combination of random letters and numbers that have no meaning whatsoever. As I’ve said I do vary this password from site to site slightly to further avoid any compromisation. Not long after all this happened I put one of these variations into a password security checker and it came back claiming it would take a standard desktop pc 125,000 years to crack this password. I then checked the shorter tesco password and it gave a result of only 10 days to crack, and that’s completely random letters with 1 number in it. Tesco’s security is clearly not up to scratch.

The site I used for this was https://howsecureismypassword.net

Additionally a few weeks after this all began for me, with Tesco denying any wrong doing on their part, their clubcard site suddenly upped the security and started asking for random numbers from your clubcard when accessing certain parts of the site. It never used to do this so clearly they are aware that the issue is the site itself.

Sorry, it’s not 9 digits for a tesco password, it’s 10 digits, however any combination of letters and numbers returns a result of 10 days to crack… simply not strong enough for a company as big as this with so much money and personal details passing through their site.

Hello Rosemary, that was me. I think it’s too late for that show now, but do feel free to send the details through to us at Which?: https://conversation.which.co.uk/contact-us/

Janet says:
14 December 2013

A friend rang me today to say that she had contacted Tesco to ask them to merge her account with her husband’s ( supposed to have been done already, but that’s another story).

They wouldn’t merge until she gives them all of her individual voucher codes and say that they can’t just merge the total amount, which makes us think that they cannot be sure how much is (or should be) in her account. Neither of these accounts are online.

*update*

Just received yet another email from tesco…
————————————————————————————————————————————-
Dear *****

Thank you for email regarding your moneycard. I am very sorry that you have not yet received this.

I have checked today and everything seems to be ok with your moneycard and it is on it’s way to you. What I would say is that there are some delays in us sending them at this time of year as we are experiencing exceptional volumes of mail and also a delay in postage.

I can assure you that your moneycard will be with you soon.

Many thanks again for taking the time to contact me about this and if there’s anything else I can help with, please feel free to contact us.

Kind regards
********** **********
Clubcard Customer Services
—————————————————————————————————————————

So all I can do is wait and see what happens right now, there’s no way of contacting this customer service rep directly for any indication of when it may arrive.

I’m not a serial complainer, I’ll use accept poor service as just one of those things that happens but we are now 98 days from the initial first promise of this being rectified, and approx 35 days from the first promise of a card within 7-10 days. There’s 8 shopping days left until Christmas and my hopes are fading fast…

Annette says:
15 December 2013

What an absolute farce. Can they manage to get anything right? I don’t think so.

When I changed my password it wouldn’t allow me to put in anything other than letters or numbers so you couldn’t put characters or symbols in, which would be more secure. I have also always used a random sequence of letters and numbers known only to me and use different passwords for each account (quite often I use different email addresses as well). That has to lead to the conclusion that either someone is hacking into Tesco’s site or it’s an inside job. Some people I have spoken to don’t use an online account at all and yet have lost vouchers in exactly the same way.

Tesco use the Clubcard to gather a lot of information about their customers, all that information is now at risk including personal details. What annoys me the most is that customers are still left to find out for themselves that this is happening and staff are largely unaware that this is an issue.

Melissa says:
16 December 2013

We too have been affected. On 7.11.13, I received an email, forwarded from an email account I no longer use, confirming my purchase. I apparently bought a book online and paid with my vouchers. I immediately rang Tesco and was told our account would be marked as fraudulent and the order cancelled. I changed the passwords on all my accounts (and in fact it was such a long time since I’d used the tesco account, I struggled to recall the details)Well, the book turned up! One month later (07.12.13) my husband went on-line to order our daughter’s christmas present as he had been waiting for it to come back in stock, to find that all our vouchers had been stolen and were in actual fact used in store, something we thought could only be done with the matching clubcard. The operator we spoke was very good, credited back our points, and was arranging for a gift card to the value of the points to be sent to us instead, and at double the amount as what we were purchasing was on the points boost scheme. It was promised to us for the end of last week, the beginning of this. I pointed out that our daughter is now unlikely to get her christmas present as it is likely to be out of stock again by the time we get the card. Well my husband decided to check the status of our account and card and was told that the card hadn’t gone out and that it was probably sitting on a manager’s desk awaiting sign-off due to the value of the card. So we have no vouchers, no card and a little girl who won’t be getting her present this year.

The whole thing is a joke, you are getting same BS I am getting… ‘The card is on it’s way’, then when it doesn’t show, ‘Sorry it’s actually not been sent yet.’ It’s not good enough, especially for a company the size of Tesco.

Everytime I see one of their Christmas adverts I want to throw the remote at the screen. Tesco – Ruining Christmas Everywhere. Every little helps? Well they are doing little and it isn’t helping.

Good luck and I hope your card arrives in time. If mine shows up I’ll be sure to post in here.

Janet says:
16 December 2013

You will be throwing more than the remote when you see the reports on how high their profits have been over the Christmas period.

Brian says:
16 December 2013

Me too! £136.50 lifted from my Points account this month. In this case there is no evidence that the account has been hacked (all details correct). And the timeframe can be narrowed down to a couple of days in December. I selected the vouchers for use in an online Tesco Direct purchase which I aborted before completing. Next day the vouchers were used instore at various locations near central London.

Does that sound suspiciously like an inside job?

Tesco immediately promised a full refund by means of a payment card.

Annette says:
16 December 2013

It definitely sounds very suspicious. Lots of people still waiting for their payment card. Tesco are in no rush to refund the money. They must have lost loads of money from this fraud. However, their profits are up so why should they care. They clearly don’t otherwise they would have sorted out this fiasco months ago.

Brian says:
16 December 2013

Saw your posting above re passwords. I totally agree – 10 alpha-numeric characters just isn’t good enough. I use a secure generator so most of my passwords are at least 13 alpha-numeric-special