Tesco online store 'is infiltrated by insider card fraudster'

The Information Commissioner and the police are investigating following evidence that the store's online shopping call centre has been infiltrated by a fraudster.

The security breach is allegedly linked to a worker who handled phone orders for items advertised on the Tesco Direct website and the related store catalogue.

Scroll down for more...

The fraud appears to have been a highly-sophisticated operation.

On one day in September, a customer's card details were recorded in the afternoon at Tesco's Cardiff call centre and fraudulent spending of £680 occurred hundreds of miles away in London within a matter of hours.

The details have raised new questions as to whether big business and the Government can be trusted to maintain the privacy of the public.

Tesco's website is the most popular Internet store in the UK and is used by tens of thousands of shoppers every day.

News that the company's security regime has been breached will make shoppers question whether they can trust the service in the run-up to Christmas.

The problems at Tesco may be the 'tip of the iceberg', according to Nigel Evans MP.

Fears have been growing that criminal gangs are targeting call centres in Britain and India to steal customer information.

The vetting of some 1.1million poorly-paid workers serving British consumers from the call centres is haphazard, without any legal requirement to conduct criminal records checks.

A Tesco call centre worker – a man from Ghana who is in the UK on a temporary working visa – has been arrested by South Wales police.

The revelations raise serious questions about Tesco's staff vetting and security systems.

The worker was allowed access to sensitive credit card details despite his temporary visa.

It is not clear whether the company carried out a criminal records check on the worker, or whether any check could be reliable given the fact he has not been in the country for very long.

A spokesman for the Information Commissioner, Richard Thomas, said: "There appears to have been a significant security breach and we will investigate that."

Mr Evans, chairman of the All- Party Group on ID Fraud, said: "We need to find out how many customers have been affected.

"I suspect this worker is just the tip of the iceberg."

Details of the crime were discovered by Tesco customer Nikki Carpenter, a recruitment company boss from Guildford, Surrey.

Miss Carpenter, 44, said: "I don't believe I was the only person whose card details were stolen and the British public will not believe it either."

The crime was uncovered after Miss Carpenter used what had been a dormant credit card to buy a television from Tesco Direct over the Internet.

The fact the card had been dormant meant that the store's computer system automatically rejected the purchase.

As a result, Miss Carpenter called Tesco Direct to place a phone order – as thousands of people do every day – using the company's 0845 number.

Cardiff call centre staff ask customers for their full credit or debit card number, as well as the threedigit security code printed on the strip on the back.

These are all the details a criminal needs to make a huge range of purchases over the Internet or by phone.

Miss Carpenter's card details were used to spend around £1,500, including the initial £680 spree.

Tesco said: "Our data protection and security procedures are amongst the most robust in the world and are not the issue here.

"As the police investigation is ongoing, we are unable to comment on the detail.

"However, the individual in question no longer works for the company and we would like to reassure customers that their data is safe with us."