Tesco cyber thieves who stole £2.5m from online customers went on spending spree in US and Brazil

THE hackers behind the Tesco Bank cyber-heist that saw 20,000 customers have money stolen from their accounts went on a spending spree in shops in the US and Brazil to launder their ill-gotten gains.

The cyber cons used data stolen from the British lender to set up contactless payment accounts on smartphones, sources said.

2

In a co-ordinated raid last weekend, they bought thousands of low-priced goods from stores, swiping their mobile phones at the tills, reports the .

Many of the fraudulent transactions are understood to have been made in the American electrical chain store, Best Buy.

The gang took £2.5million from 9,000 Tesco Bank customers before the lender detected suspicious activity and froze all online payments.

2

The revelations will ramp up the pressure on the supermarket’s banking division, whose reputation has been damaged by the raid.

Cyber-security experts said Tesco should have acted more quickly to stop the flood of payments to overseas stores. The thieves loaded up on cheap goods to get around limits on mobile phone transactions.

“It didn’t feel as if Tesco Bank had much of a contingency plan in place,” said Dave Palmer of cyber-security firm Darktrace.

Related stories

WIKI-EATS

Pamela Anderson arrives at Ecuadorian embassy with food parcel of veggie burgers for Julian Assange

CLASH OF THE TITANS

First ever boxing match between SAS and US Special Forces hailed a 'success'

FINAL TRAM CRASH VICTIM

Tram crash victim pictured as family reveal they waited THREE days for cops to confirm his death

NICE PLY

ISIS jihadis using WOODEN TANKS as a diversion tactic as war rages against terror rebels in Mosul

“It would appear the bank did not foresee that so many small frauds could happen all at once.”

Tesco Bank declined to comment on the details of the raid, but insisted none of the personal data of their customers had been “compromised”, and that it had reimbursed victims.

It has contacted the National Cyber Security Centre, a wing of spy agency GCHQ, to help with its investigation into the attack — the most expensive yet on a British bank’s IT systems.

Posts on the “dark web” — a shadowy part of the internet where users can browse anonymously — suggest Tesco may have been in the sights of cyber-thieves for some time.

In September, a fraudster operating on AlphaBay, an online marketplace for drugs, guns and other illicit goods, claimed he had an insider at Tesco Bank who could provide customer account data.

Last week it emerged that hackers had accessed the email addresses, passwords and phone numbers of 711,000 job applicants on recruitment giant Michael Page’s books.

We pay for your stories! Do you have a story for The Sun Online news team? Email us at [email protected] or call 0207 782 4368