# Tesco Clubcard Credit Card



## dee4life2005 (Sep 18, 2007)

Sorry, this is probably going to be a bit of a rant. Stay with it, the end is truly shocking, and possibly an indication of their security practises.

I've had a tesco clubcard credit for a while, and thought I would register the "clubcard" part of it online so that I could view my points balance, vouchers etc. online - not something you can see from their "credit card" portal.

There was a problem with this, for security reasons apparently. So I had to register for a clubcard account and then use the secure email facility to let them know the account email address I registered with and the "clubcard number" I want assigned to the account. They would then manually assign the clubcard number to my account.

Being paranoid, and being a database developer, this "manual" assigning raised alarm bells. Anyway, they said they had successfully added that card number to my account, and I'd see it in 24 hours. 1 week later, still nothing.

Now for the worrying part. I just got a phone call at work, from my mum, who had just logged in to her credit card account (completely separate from mine, but both registered at same address - I still live at home). All of her details have been replaced with mine (name,address, dob etc.) and my cards have been added to her list of cards. She can also see all of my credit card transaction activity online (as they accrue points), including purchase location, dates, amount and points accrued. She also has all my vouchers added to her account - though thankfully she hasn't decided to spend them yet :thumb:

I would say that this is a very serious error on their part - especially as it involves credit card related transaction information. It appears they've decided to merge our two accounts, without any prior authorisation or requests from either of us.

Surely this is some kind of data protection related breach of trust, and as such so be reported to some kind of official body, in addition to their customer support.

My mum has now emailed their customer support to try and get them to reverse whatever it is that they have done ... but I don't hold out much hope that they'll get it right.

This also got me wondering ... a few months ago I had some "fraudulent" activity on my tesco credit card (since cancelled and re-issued), and I wonder if this was some other screw up on their part.

It makes you wonder how safe your data really is with these people.

[rant over]

So, should I report this, and to whom ?


----------



## CleanCar99 (Dec 30, 2011)

Get a credit check done on yourself and you can see anyone that lives at the address past and present's credit status and details of their cards loans etc. Its shocking.


----------



## empsburna (Apr 5, 2006)

That does sound like an information security breach - although I don't know if it would fall under "Protection of stored cardholder data" in PCI DSS.

Either way, they have let someone else view PII (which can be costly if they lose a lot of it!) and there are enough unique identifiers in there so the other party could pick you out (doesn't matter who has viewed it, parent, sister, best friend).


----------



## Ravinder (Jul 24, 2009)

Call them and complain. Major breach! You could get some decent amount of compensation.


----------



## vickky453 (Feb 27, 2009)

This happened with mine! They put my mums clubcard on my credit account. At the time, We lived at the same address. When My mum goes online to buy food, she can see my card account activity


----------



## dee4life2005 (Sep 18, 2007)

vickky453 said:


> This happened with mine! They put my mums clubcard on my credit account. At the time, We lived at the same address. When My mum goes online to buy food, she can see my card account activity


Did you have any luck getting your resolved ?


----------



## dee4life2005 (Sep 18, 2007)

Just an update on this, for those that may be interested.

It's still not resolved, after a further 8-10 emails. So that's 4 weeks since they incorrectly merged our accounts, and 5-6 weeks since I originally asked them to add my clubcard (embossed on by Tesco credit card) to my clubcard account.

In trying to resolve the situation they have:

said they've fixed the issue and to wait 24-48 hours - this has happened twice.
They've asked my mum to scan her clubcard to prove which number is hers, so that they could remove my cards from her account, leaving just her card. However, when the did this they removed her card from her account leaving her with just my cards.
Gone through a statement run in the middle of this, and all of the vouchers that I should have been issued are issued with my name but my mum's clubcard number. They don't seem interested in resolving this either.

The merging of the accounts, from what I understand from their replies, was performed by Tesco Bank as it involves a Tesco Clubcard Credit. However, the seriously iffy thing that I've just received in the latest email is that "Tesco Bank have no facility to check a clubcard". I'm assuming that this means that they can't see the name / address / postcode etc. of the person that a clubcard is registered to.

So what happens if I had supplied a clubcard number and mistakenly transposed a few digits and it just so happened that the resulting card number was a valid clubcard number that belonged to a Mr Joe Bloggs. If they have no way of checking a clubcard (account) then presumably they would have just gone ahead and merged this the same as they did with my card and my mums account - without any safeguards to prevent it!

As soon as they manage to add my mum's card back on to her account, wether the resolve the situation on my clubcard account or not, I will be closing all accounts I hold with them - and taking my business elsewhere. This includes petrol, shopping - the full works. With a thirsty Focus ST running on super unleaded that's about £4k in fuel that they'll be missing out on, without the credit card / shopping spend.

I'm also going to be writing them an official complaint, and reporting them to the ICO - as this shows potentially dubious data practices going on here. Certainly doesn't inspire much confidence in their security of your data.


----------



## dee4life2005 (Sep 18, 2007)

It's not like the emails I've been writing them could have been lost in translation or anything as the Tesco Customer Service centre is in my hometown - which makes the whole thing even more of a joke.


----------



## PG Monkey (Apr 19, 2010)

If you escalate a complaint about them to the Financial Ombudsman Service, they have to pay the FOS a £500 case fee. Worth doing if they do not resolve the matter to your satisfaction. 

Keep a record of any time you spend on resolving it as the FOS have been known to award compensation for reasonable time spent on the dispute.


----------



## dee4life2005 (Sep 18, 2007)

thanks for the suggestion. 
I think 6 weeks is more than enough time to resolve this - it is 6 attempts they've now had. I thought about phoning them up to resolve it, but once they merged my account with my mum's I probably would have lost the plot on the phone, so thought it best to email them instead.

Plus side is that by emailing them I have everything documented so can't be fobbed of with the usual "we have no record of your previous call(s)" which they are well known for apparently.

If it's not sorted this time then it's definitely official complaint to Tesco and the ICO. I think the FOS would be interested as well, and as tesco would have to pay the FOS a case fee that's just an added plus :thumb:

I could even use my web development knowledge to set up a website, and with the write meta tags, keywords and other bits and pieces it could get high enough in the search results that Tesco would take a bit more notice. That could be opening a can of worms though, which is why I've not gone down that route yet.


----------



## swordjo (Sep 17, 2006)

All the Clubcard facilty eg points etc is supported by Clubcard and not by Tesco Bank, the customer service staff at Tesco Bank would only be able to help with transaction/balance queries of spending on the card, Clubcard should be dealing with the assignment of points and matching the cards up. In saying that someone at Tesco Bank credit card customer services should have a direct contact at Clubcard to get this resolved for you.


----------

