As well as the main Times article today there is one on page 6 about people having their bank accounts "cleared out".

A couple of extracts , my bold :-

Donna xxxx, 43, a mother of two, told how an attempt to take funds from her bank account was only thwarted because Santander became suspicious and blocked it.
...
She has linked the breach to TalkTalk because her banking and internet passwords were the same.

Elizabeth xxxx, 46, a tutor at the University of xxxxx, was a customer of Onetel until it was bought out by TalkTalk. She said her Onetel email was hacked in the past three weeks and her TalkTalk phone bill suddenly shot up this month without bearing any relation to usage.

�Like every other person in this country you go with an account password which is easy to remember and use the same one for lots of different things, like online banking,� she said.

D'oh !!!!!

Yeah that's bad. But I personally wouldn't use an online bank account with BACS facilities without PIN Sentry type device anyway.

I have different passwords for every site i use. Just write them down so you dont forget. Saves hassle of one site is hacked. No need to change the rest

Do you ever supply TT with your bank card number? They will have your account number to set up the DD but they cant clear your account with that only set up a DD

Given the bank details I doubt if that matters very much to the hackers.

For instance, my RBS and IOM Bank (an RBS subsidiary) card readers use the same algorithm to calculate the response key. I expect NatWest also use it.

They could either re-assign a clone card or just hack the algorithm at some time in the past and give the correct responses online when requested.

Edit - Ah, they probably need the full number of the bank card.

Edited by RobertoS (Sat 24-Oct-15 15:32:49)

In reply to a post by Oliver341:

Yeah that's bad. But I personally wouldn't use an online bank account with BACS facilities without PIN Sentry type device anyway.

Or make banks offer 2 steo verification. Its so simple and adds an extra layer of protection. I have it enabled for Outlook, Gmail and Facebook. Even if Mr Hacker knew my password without my phone it would be pointless

I don't use TT, though they probably have my name, address and phone number. Nothing else.

In reply to a post by bobble_bob:

I have different passwords for every site i use. Just write them down so you dont forget.

Errrmmm. Wasn't that the point I was making? The whole reason for my post?

My bank passwords and PINs are not written down. No financial ones are. Only non-critical ones. Just hope yours aren't found by a burglar.

Which most companies sell anyway. Ive had calls on my mobile asking if i have been in an accident and they quote my full name. Someone sold them that data

Yea i know thats what your post about just saying what i do. id rather have it written down on paper than trust any other organisation to keep my details safe. Wasnt a password manager recently compromised?

I believe one was, yes. I've never even considered using one. A totally daft idea.