Sounds like it's a breach from within (or at least not though compromised accounts), this would explain the lack of concern from Tesco about resting security (much to the chagrin of customers, i'm sure) and the huge numbers of affected accounts.

The types of 2FA vary dramatically between banks. Some use an SMS OTP but as we know phone numbers aren't secure [0]. Most use a card reader but they often do this differently. Some use the 'identify' function to log on and the 'sign' function for payments (as designed) but others use the 'respond' function for everything. The danger in using 'respond' for payments is that the account and amount aren't entered into the card reader so you don't know what you are authorising.

<pure-speculation>

If Tesco have a flaw in how they are using 2FA, by only using 'respond', then local malware could intercept genuine payments, alter the account/amount details, and get the user to authorise this. Or Android malware could intercept SMS messages. N.B. This assumes the issue is in the faster payments system but it could be in the payment card system. It appears cash points still work but this is a separate system to debit card payments.

</pure-speculation>

From what I've read no one will lose money but having transactions frozen is still a big inconvenience. As mentioned elsewhere here, this is why it's a good idea to have many different bank accounts from various parent institutions (also important from a deposit guarantee position). Some banks share the same infrastructure and liability. Always have some cash available too, although that is getting harder to spend everywhere [1].

[0]: https://unop.uk/phone-numbers-for-examples-and-user-identifi...

[1]: https://unop.uk/do-you-accept-cash/

Hell, I can't even get authenticated with my provider half the time because the simcard comes with it's ID/PIN/password that is printed on your contract. You need that to do any changes on your account.

I personally think cell phones can be made secure enough and are the most convenient. If somebody really wants to fuck with you, they will anyway, for most people there is not much point to it anyway

If tested systems that allow you to transfer money between accounts, if you can bypass the initial authentication you can transfer money without needing to use 2FA or generating a TUN code.

And these systems can be breached.

    /transfer_money?from_account=NNNN&to_account=MMMM&amount=$$$$

I personally doubt this will be revealed to be a software security issue.

So they may still be vulnerable. If UK customers can find a low (or no) cost alternative place to put what remains of their money, I'd do that now. This might not be over.

They may not know how the attackers gained access or if they're still inside until incident responders have done a full workup on the network.

http://www.computerweekly.com/news/2240222351/Tesco-Bank-lau...

Forex typically means buying or selling currencies, not transferring money between parties.

Also means the receiver doesn't get hit with fees to receive an international payment.

If it was a card details leak, I'd have expected cards to be cancelled, and not allowing them to continue to be used.

Unfortunately that's totally plausible, and infact, are the profitable customers for credit card companies. Why give a credit card to someone who can pay off their bills in full every month, when you can give someone more credit than they earn, let them spend it all, and then pay you monthly with interest?

As a point of reference, my Amex limit is 5x my monthly post-tax earnings. Back when I was only eligible for entry cards, at £250 limit increased to >£5k within a year.