An interview with Tesco exec on Radio 4 this morning suggested something like this was going on. Obvs they don't say what their detection rules are. Which makes you wonder how the attackers gamed them (inside info, or reverse engineering after compromising many accounts?)