FCA fines Tesco Bank £16.4m after 2016 cyber attack

'Customers should not have been exposed to the risk at all'

The Financial Conduct Authority (FCA) has fined Tesco Bank £16.4m for its failure to adequately protect customers from a 2016 cyber attack, which saw fraudsters claim over £2.2m worth of transactions over a 48-hour period.

Tesco Bank failed to exercise due skill, care and diligence in protecting its personal current account holders in a "largely avoidable" attack that saw cyber criminals exploit deficiencies in the design of its debit card, its financial crime controls and the competence of its Financial Crime Operations Team. 100 days to GDPR: The legislation that wealth managers say will have the biggest impact in 2018 According to the regulator's 1 October enforcement notice, the attackers are understood to have used an algorithm that generated authentic Tesco Bank debit card numbers and, using those...