Now MY Tesco Clubcard points get stolen!

I have written a couple of pieces on Head for Points over the last year about people getting their Tesco Clubcard points stolen.  It is becoming an increasing problem.

Is it Royal Mail?  Is it Tesco employees?  It is difficult to tell.

Over the weekend I had this email from Tesco:

Dear Rob

At Tesco we constantly monitor all of our systems and take the security of our customer’s data very seriously. Our team have noticed some irregular activity on your Tesco Clubcard account and we have cancelled all your vouchers as a precaution.

We will update your account balance accordingly within the next 48 hours and issue you with replacement vouchers in our next mailing commencing in August. However, if you wish to use your voucher(s) prior to this, please call our helpline on 0800 023 4761 who will be happy to assist. 

As part of our ongoing work to protect you online we are asking you to create a new stronger password before you log in to your Tesco.com account.

[snip]

Thank you for taking the time to read this and we would like to apologise for any inconvenience that this may have caused you, however we hope you can appreciate that we are acting to ensure your account is secure.

Kind regards

Confession time.  I have written on here before that because I use AwardWallet to track my balances, I would be informed if my points went missing.  This is incorrect.  Whilst AwardWallet DOES inform me when my current points balance moves, it does NOT inform me when my ‘unspent vouchers’ total moves.

This is because Award Wallet does not inform you about movements in ‘second-level data’ which is what this is.  You also, for example, do not get told if a BA Amex 241 voucher is added to your account even though it shows on AwardWallet.

I mention this because, when I look at my transactions, it seems that the first odd transaction happened in March and I missed it.  This is what was spent:

26 March – £xx – Andover

9 April – £xx – Prescot Extra

15 May – £xx – Aylesbury

The paper vouchers issued to me are still in my desk.  Someone had accessed my Clubcard account and printed off extra copies of some of the vouchers.  The usage pattern is a little weird, to be honest – why wait two weeks after the first transaction to do the second one (which was 10 x larger) giving me plenty of time to notice?

Tesco did a good job of spotting this fraud.

They did a bad job of explaining it to me.

If you look at the email, it implies that they spotted the fraud and refunded me.  This was not correct.  They did refund the Aylesbury transaction which is what had triggered the review.  They had NOT refunded the Prescot or Andover transactions and did not do so until I called them.  

To be fair, they could not be 100% certain that I had not done these – although it is unlikely as I have never used a Tesco anywhere near there – but the email should have asked me to check my transactions.

Additionally, whilst the email asks me to change my password it was not compulsory.  You would have expected Tesco to insist on a password change at the next log-in, but it didn’t.

I have no idea how this happened.  My password was not too secure but I know people with super-tough passwords who have also been defrauded.  You could try to point the figure at AwardWallet but there are plenty of fraud cases from people who do not use them.

As these vouchers were from my February mailing, it is NOT Royal Mail as I have the vouchers.  The finger points pretty clearly to someone at Tesco.  It is worth noting that the Aylesbury voucher was used after Tesco brought in its additional security checks although it is possible it had been printed off earlier.

There is some upside

Tesco is going to reissue all of my vouchers in August.  This will reset the expiry date on all of them for two years.

They were also happy to let me redeem some points for Thomas Land today so I am still able to spend points even though I have no ‘live’ vouchers.

Tesco answered my telephone call promptly and the guy I spoke with was very efficient in looking through my account and calling back when he said he would.  They did do a good job here.

Time to tighten up security further though.  Sainsbury does not allow you to redeem Nectar points unless you have previously shopped in that store.  I don’t think it would cause much inconvenience if Tesco went the same way.

---

How to earn Avios from UK credit cards (April 2024)

As a reminder, there are various ways of earning Avios points from UK credit cards.  Many cards also have generous sign-up bonuses!

In February 2022, Barclaycard launched two exciting new Barclaycard Avios Mastercard cards with a bonus of up to 25,000 Avios. You can apply here.

You qualify for the bonus on these cards even if you have a British Airways American Express card:

There are two official British Airways American Express cards with attractive sign-up bonuses:

You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points. These points convert at 1:1 into Avios.

Run your own business?

We recommend Capital on Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card, along with a sign-up bonus worth 10,500 Avios.

SPECIAL OFFER: Until 12th May 2024, the Capital on Tap Business Rewards Visa card is offering a bonus of 30,000 points, convertible into 30,000 Avios. You must have a Limited Company to apply. Click here to learn more and click here to apply.

You should also consider the British Airways Accelerating Business credit card. This is open to sole traders as well as limited companies and has a 30,000 Avios sign-up bonus.

There are also generous bonuses on the two American Express Business cards, with the points converting at 1:1 into Avios. These cards are open to sole traders as well as limited companies.

Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.