Maximise your Avios, air miles and hotel points

Now MY Tesco Clubcard points get stolen!

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

I have written a couple of pieces on Head for Points over the last year about people getting their Tesco Clubcard points stolen.  It is becoming an increasing problem.

Is it Royal Mail?  Is it Tesco employees?  It is difficult to tell.

Over the weekend I had this email from Tesco:

Dear Rob

At Tesco we constantly monitor all of our systems and take the security of our customer’s data very seriously. Our team have noticed some irregular activity on your Tesco Clubcard account and we have cancelled all your vouchers as a precaution.

We will update your account balance accordingly within the next 48 hours and issue you with replacement vouchers in our next mailing commencing in August. However, if you wish to use your voucher(s) prior to this, please call our helpline on 0800 023 4761 who will be happy to assist. 

As part of our ongoing work to protect you online we are asking you to create a new stronger password before you log in to your Tesco.com account.

[snip]

Thank you for taking the time to read this and we would like to apologise for any inconvenience that this may have caused you, however we hope you can appreciate that we are acting to ensure your account is secure.

Kind regards

Confession time.  I have written on here before that because I use AwardWallet to track my balances, I would be informed if my points went missing.  This is incorrect.  Whilst AwardWallet DOES inform me when my current points balance moves, it does NOT inform me when my ‘unspent vouchers’ total moves.

This is because Award Wallet does not inform you about movements in ‘second-level data’ which is what this is.  You also, for example, do not get told if a BA Amex 241 voucher is added to your account even though it shows on AwardWallet.

I mention this because, when I look at my transactions, it seems that the first odd transaction happened in March and I missed it.  This is what was spent:

26 March – £xx – Andover

9 April – £xx – Prescot Extra

15 May – £xx – Aylesbury

The paper vouchers issued to me are still in my desk.  Someone had accessed my Clubcard account and printed off extra copies of some of the vouchers.  The usage pattern is a little weird, to be honest – why wait two weeks after the first transaction to do the second one (which was 10 x larger) giving me plenty of time to notice?

Tesco did a good job of spotting this fraud.

They did a bad job of explaining it to me.

If you look at the email, it implies that they spotted the fraud and refunded me.  This was not correct.  They did refund the Aylesbury transaction which is what had triggered the review.  They had NOT refunded the Prescot or Andover transactions and did not do so until I called them.  

To be fair, they could not be 100% certain that I had not done these – although it is unlikely as I have never used a Tesco anywhere near there – but the email should have asked me to check my transactions.

Additionally, whilst the email asks me to change my password it was not compulsory.  You would have expected Tesco to insist on a password change at the next log-in, but it didn’t.

I have no idea how this happened.  My password was not too secure but I know people with super-tough passwords who have also been defrauded.  You could try to point the figure at AwardWallet but there are plenty of fraud cases from people who do not use them.

As these vouchers were from my February mailing, it is NOT Royal Mail as I have the vouchers.  The finger points pretty clearly to someone at Tesco.  It is worth noting that the Aylesbury voucher was used after Tesco brought in its additional security checks although it is possible it had been printed off earlier.

There is some upside

Tesco is going to reissue all of my vouchers in August.  This will reset the expiry date on all of them for two years.

They were also happy to let me redeem some points for Thomas Land today so I am still able to spend points even though I have no ‘live’ vouchers.

Tesco answered my telephone call promptly and the guy I spoke with was very efficient in looking through my account and calling back when he said he would.  They did do a good job here.

Time to tighten up security further though.  Sainsbury does not allow you to redeem Nectar points unless you have previously shopped in that store.  I don’t think it would cause much inconvenience if Tesco went the same way.


How to earn Avios from UK credit cards

How to earn Avios from UK credit cards (April 2024)

As a reminder, there are various ways of earning Avios points from UK credit cards.  Many cards also have generous sign-up bonuses!

In February 2022, Barclaycard launched two exciting new Barclaycard Avios Mastercard cards with a bonus of up to 25,000 Avios. You can apply here.

You qualify for the bonus on these cards even if you have a British Airways American Express card:

Barclaycard Avios Plus card

Barclaycard Avios Plus Mastercard

Get 25,000 Avios for signing up and an upgrade voucher at £10,000 Read our full review

Barclaycard Avios card

Barclaycard Avios Mastercard

5,000 Avios for signing up and an upgrade voucher at £20,000 Read our full review

There are two official British Airways American Express cards with attractive sign-up bonuses:

British Airways American Express Premium Plus

25,000 Avios and the famous annual 2-4-1 voucher Read our full review

British Airways American Express

5,000 Avios for signing up and an Economy 2-4-1 voucher for spending £15,000 Read our full review

You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points. These points convert at 1:1 into Avios.

American Express Preferred Rewards Gold

Your best beginner’s card – 20,000 points, FREE for a year & four airport lounge passes Read our full review

The Platinum Card from American Express

40,000 bonus points and a huge range of valuable benefits – for a fee Read our full review

Run your own business?

We recommend Capital on Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card, along with a sign-up bonus worth 10,500 Avios.

Capital on Tap Business Rewards Visa

Huge 30,000 points bonus until 12th May 2024 Read our full review

You should also consider the British Airways Accelerating Business credit card. This is open to sole traders as well as limited companies and has a 30,000 Avios sign-up bonus.

British Airways Accelerating Business American Express

30,000 Avios sign-up bonus – plus annual bonuses of up to 30,000 Avios Read our full review

There are also generous bonuses on the two American Express Business cards, with the points converting at 1:1 into Avios. These cards are open to sole traders as well as limited companies.

American Express Business Platinum

40,000 points sign-up bonus and an annual £200 Amex Travel credit Read our full review

American Express Business Gold

20,000 points sign-up bonus and FREE for a year Read our full review

Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.

Comments (110)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • Mark says:

    Raffles, your post prompted my to check my voucher usage today; sure enough, £50 spent at “GREENFORD DOT COM” which is nowhere near me, and not something I would spend it on. In common with others, it only took 10 mins on the phone to sort it out, and it was a relatively small balance shift so I hadn’t noticed it. Thanks for the post!

    • Idrive says:

      That is a Tesco online shop (when you buy online), that would mean they would have logged in with your credentials.

      Though, it could be at source level from people with permissions that do not even need to hack the logins, they might see everything in clear and with sorting ability!
      but all this about internal staff thing is a strong allegation towards a quoted company, which should do something as they are also offering also financial services!

      • Mark says:

        The password (now changed!) was not one which I use on other sites, so if it was leaked it had to have come from Tesco.

        • Idrive says:

          A security and database expert should now how these thongs work..or reading the News.. Also remember about that bug which was revealed a few weeks ago..but mule seems to e the first choice

          • andrew s says:

            The password is almost certainly stored encrypted in a database. This is lesson one in database design and has been for 20 years. I just cannot believe that anyone inside Tesco (short of the Chief security officer) is able to gain access to a naked password.

            Even in the recent ebay breach the passwords were stolen in encrypted form, and useless for any attacker.

  • Graeme Archer says:

    I knew that none of mine had been nicked, but I thought I’d have a look anyway – they’ve had £125.50 from me in the last 24 days! They were three online transactions with a Clubcard number attached, so the unhelpful lady on the phone reckons they can be traced – not that I’ll ever know.

    • Andrew says:

      I had my vouchers stolen a few months ago, a 4 figure amount, and i have to say Tesco were very efficient about returning the vouchers and crediting them back to my account. If Tesco don’t know why its happening, i’m surprised they haven’t called in the police etc to sort it, esp as surely the online orders or their cctv should be able to track these things, esp as it seems to be being spent in a small selection of stores. Very strange to say the least!

  • squills says:

    It IS very strange. Tesco have so many problems at the moment, they probably don’t want to admit that when you sign up with them for Grocery deliveries etc, you risk your internet security – ie so many people use the same ID & password on multiple sites, then if Tesco is compromised, so are all your other sites.

    The fraud is so prevalent: it HAS to be an inside job by a sophisticated team.

    Tesco’s security measures are laughable. The guys who said all this 3 digit stuff is pathetic are right.
    1. You get multiple attempts to input the 3 digits
    2. You can circumvent all that by just knowing email address & password, ie just order the goods and use vouchers to pay.

  • What's the Point says:

    Got my “letter” today. Tesco have converted £200 + back to points, but can’t see what someone has tried to use them for yet.
    Something has clearly gone majorly wrong with Tesco security measures for so many people to be targeted.

  • Pat Bucher says:

    Just checked my account and I’ve been done again! Only a few vouchers and spent in a store in a totally different area from last time.

  • Martin says:

    I’ve been cleaned out as well. They changed the name on my account, but not the address, so I received the clubcard statement today and noticed a) the name change, b) the almost zero balance – and they’ve spent all my vouchers 200 miles away from me in the London area – in small transactions. I think the previous posts are right, only a very small chance of an Avios bonus so far safer to auto-convert.

  • Bialynia says:

    I feel like I might be a little naive here. When Tesco periodically send us their vouchers for discounts in store, which used to be quite good but are now pitiful (my last two batches offer money off specific items, eg. 25p or 50p, and only one voucher was was 20 bonus clubcard points if I bought some of their ‘Be Good to Yourself’ Cottage Cheese. Funny thing is, the nutritional information on the expensive ”Be Good to Yourself Cottage Cheese has the exact nutritional information to their economy Cottage Cheese brand, and I can’t taste any difference, which leads me to suspect that they are exactly the same product, in different packaging and with the economy product being MUCH cheaper, making using the 20 bonus CC points feel like a con. But, anyway, I’ve sidetracked. Every time I have used any of these promotional vouchers they have asked for my Clubcard as the promotional discounts will not be applied if the Clubcard isn’t used at the same time. When using the stolen vouchers in different stores, are the thieves not also asked for the Clubcard before they can cash in those vouchers? If they aren’t, then it seems a pretty silly oversight considering the losses incurred from these frauds, and if they are being asked to provide the Clubcard as well, then how are they able to do this, unless it really is some kind of inside job?

    I have £130 in Clubcard vouchers, I have been waiting for an Avios bonus exchange but it has been so long since one that I am beginning to feel like I am waiting for Godot. Is it just time for me to call it a day and forget about holding out and longer for a Clubcard to Avios bonus exchange and should I Just exchange them at the standard rate? Thoughts of Raffles and other HfP members would be greatly appreciated here, as I’m not sure what the wisest step to take next is. Best wishes to you all.

    • Rob says:

      You don’t need to show the Clubcard to redeem a voucher. No idea why!

      Conversion – I don’t see the point to be honest. If Avios launch a surprise sale today and you want to redeem, you can redeem and get the Avios within 24 hours. With conversion so quick, doing it early means a) you might miss a bonus and b) you might miss out on an excellent deal from another Boost partner which ends up being more valuable.

      • Bialynia says:

        Seems to me like half their fraud issues would be solved if you had to show your clubcard along with the voucher or money off token at the point of sale.

        As for conversions, mostly thanks to HfP, since I started using it a year ago, I have accrued 9,596 BAEC Avios and almost £130 in Clubcard vouchers, but I’m starting to think that perhaps I missed the boat on Clubcard to Tesco conversion bonuses.

        Oh, and that’s not forgetting the approx £150,000,000 I also earned in RedSpottedHanky vouchers. I was beginning to feel sorry for them but finally my vouchers ran out last week and for the first time I ended up paying for a train ticket with them, which made me feel better about myself!

  • avidsaver says:

    I’ve been checking my Tesco CC each morning recently as I’ve still not received my vouchers for this quarter and wondered if they may have been pinched in the post. Low and behold I’ve had a voucher from the last quarter used two days ago on “Tesco Boost”. Phoned the CC helpline straight away. As with others, all my vouchers are now being cancelled and will be re-issued in August. I was told they would email their “fraud dept” and should I wish to make use of any vouchers in the meantime I could phone them and they would organise it for me over the phone. I agree with others that the security check when you call is pathetic. Surely Tesco will get their finger out and upgrade their security soon?

This article is closed to new comments. Feel free to ask your question in the HfP forums.

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.