Yahoo Finance TSB could face fine for system outage and potential data breach
TSB could be in line for a hefty fine after a botched system upgrade left customers unable to use online and mobile banking services for a fourth day and sparked fears of a data breach.
Customers of the challenger bank took to social media to vent their anger after outages prevented some from making transfers, paying bills and checking balances.
Others claimed that when they did manage to log in they were able to access other people’s money.
Niall McDonnell, 28, told The Daily Telegraph that he was able to see a business account on his profile when he logged in, which contained over £2.8m. He sent a screenshot to the City watchdog and data regulator the Information Commissioner's Office (ICO).
Another customer said she was able to see the account details of four other people. Ashley Tait, 25, said that her father was able to see her account details and balances when he logged in to his own account.
TSB customer Matthew Neal told the BBC he was given access to someone else’s £35,000 savings account after logging on to his account on Sunday evening to check how much he'd spent the night before in the pub.
Its a joke mate. Were stranded abroad as still sayin we have nothing. We had rest of our holiday money there and have been stuck in apartment all day
— Christopher burns (@Chriissybee1) April 22, 2018
"I could see all my accounts, but on top of that also three accounts belonging to someone else: a £35,000 savings account, an £11,000 Isa and a business account," he said.
"I could see their account numbers, sort codes and transaction histories and I had access to transfer money too, if I was that way inclined. The thing that was worrying me most was: what if someone can see mine too?"
A TSB spokesman said the specific access issues related to seeing multiple accounts "lasted only about 20 minutes and impacted just a tiny fraction of our customer base and were fixed last night".
Both the Financial Conduct Authority (FCA) and the ICO said they were monitoring the situation. The watchdogs have the power to investigate and potentially fine TSB for a system failure or data breach respectively.
The problems struck as TSB tried to complete the final stage of its self-styled “liberation” from its old owner Lloyds – from which it was spun out in 2013, but continued to rent its IT system.
Customers had been warned the transfer of 1.3 billion customer records to a new system could impact services from 4pm on Friday to 6pm on Sunday – but the disruption continued overnight and into Monday.
A TSB spokesman blamed the “large volumes of customers” trying to access its online and mobile banking services for continuing “intermittent issues”.
Why am I still unable to access my account @TSB@TSB_News ?? It’s nearly 24 hours past the time you said it would be fixed. This is unacceptable. #tsbdownpic.twitter.com/AytrwJFrRn
— Robert McM (@RobertMcM81) April 23, 2018
The spokesman added: “We are really sorry for the inconvenience this is causing our customers and want them to know we are working as hard and as fast as we can to resolve this problem.”
The FCA has the power to launch a formal investigation into a bank for a system failure, regardless of whether it receives complaints.
In 2014, RBS was fined £56m by the FCA for a breach of its rules after outages that affected more than 6.5 million customers over several weeks.
The FCA confirmed it was “aware of the issue” and was in contact with TSB, but declined to comment further.
Data regulator the Information Commissioner’s Office also said it was “making enquiries” about the “potential data breach”. In the past it has levied fines of up to £400,000.
Meanwhile the Bank of England – which oversees the stability of banks – is also understood to be monitoring the situation. It declined to comment.
A senior source at a rival UK bank said it was conceivable that TSB may have to switch back to the Lloyds system if the problems continue.
“If they can’t fix it they may well need to revert to the approach adopted prior to the changes that have caused the current issues. This would be very much a near last resort option,” the source said. Lloyds declined to comment on this.
TSB’s parent company Sabadell issued a statement today hailing the “successful completion” of the system transfer to its own platform, called Proteo4UK.
The Catalan bank’s chairman Josep Oliu said: “With this migration, Sabadell has proven its technological management capacity, not only in national migrations, but also on an international scale.”
