{"id":564,"date":"2025-06-03T10:34:55","date_gmt":"2025-06-03T10:34:55","guid":{"rendered":"https:\/\/mississaugaoffice.com\/?p=564"},"modified":"2025-06-20T09:44:03","modified_gmt":"2025-06-20T09:44:03","slug":"sainsburys-shoppers-still-losing-millions-of-nectar-points-in-widespread-scam","status":"publish","type":"post","link":"https:\/\/mississaugaoffice.com\/index.php\/2025\/06\/03\/sainsburys-shoppers-still-losing-millions-of-nectar-points-in-widespread-scam\/","title":{"rendered":"Sainsbury\u2019s shoppers still losing millions of Nectar points in widespread scam"},"content":{"rendered":"
\n
\n\t\t\"Amber\t<\/div>
Amber Shuker-Bright (left) and Fariba Rad (right) were among those affected<\/figcaption><\/figure>\n

Scammers are still having a shopping spree with stolen Nectar points, with shoppers seeing their accounts drained in places they have never visited. <\/p>\n

Meanwhile, some say they have been locked out of their accounts entirely and have asked Sainsbury’s<\/a> for an explanation. <\/p>\n

The supermarket introduced an \u2018account lock\u2019 feature to their loyalty app in February to try and crack down on the problem \u2013 but customer services reps are still fielding dozens of complaints.<\/p>\n

Mum-of-two Fariba Rad, from Putney in London<\/a>, told Metro <\/strong>she was \u2018really upset\u2019 to get two emails on Sunday morning thanking her for spending her balance.<\/p>\n

\u2018First I started thinking about when I was at Sainsbury\u2019s, but then I saw the area was Oakley and I said to myself, \u201csomeone\u2019s hacked my points\u201d,\u2019 she said. <\/p>\n

The thieves spent \u00a312.50 in two transactions of 1000 and 1500 points, leaving her with only 194 points left worth 97p. <\/p>\n

\n
\n\t\t\"Nectar\t<\/div>
One shopper asked a customer service rep, ‘What on earth is happening?’<\/figcaption><\/figure>\n
\n
\n\t\t\"Nectar\t<\/div>
Another said they were ‘going nuts’ trying to resolve \u00a3100 of lost points and then being locked out of their account<\/figcaption><\/figure>\n
\n
\n\t\t\"Nectar\t<\/div>
Another asked, ‘I see your feed full of the same issues. Do you have a major problem?’<\/figcaption><\/figure>\n

Some shoppers contacting Nectar online said their points had been spent while they weren’t even in the UK, while others said they were having problems with the app and ‘can’t even log in’.<\/p>\n

In recent months, retail cybersecurity has come into the spotlight after Marks and Spencer was hit by a devastating hack<\/a> which is still not completely resolved, with online shopping unavailable. <\/p>\n

Supermarkets Co-op and Harrods were targeted by hackers too<\/a>, while sports brand Adidas also fell victim<\/a> – so the natural question for many was if Sainsbury’s could also have been compromised. <\/p>\n

But the supermarket said they were not experiencing any IT issues. <\/p>\n

They confirmed that Fariba had fallen victim to fraud, and that criminals use a range of tactics to try and profit from their popular loyalty scheme, which has over 23 million members. <\/p>\n

The ease with which scammers can access Nectar points was revealed in January, when This Is Money<\/a> revealed over 12 million points worth some \u00a363,000 had been taken in the year prior.\u00a0<\/p>\n

\n

\n\t\t\t\t'I haven't even left my house'\t\t\t<\/h2>\n
\n

Another Sainsbury\u2019s shopper, 43-year-old Amber Shuker-Bright, pictured at the top of this article, said she and her husband lost \u00a360 of points.<\/p>\n

\u2018We do what most people do \u2013 save them for Christmas,\u2019 the mum-of-one told Metro<\/strong>.<\/p>\n

She realised something was wrong when she got an email thanking her for redeeming 2000 points in Brixton on April 12, but thought: \u2018I\u2019m in Putney and I haven\u2019t even left my house.’<\/p>\n

The mum-of-one said her husband lost even more this weekend, when scammers spent 10,000 of his points, worth \u00a350, in Camden. <\/p>\n

She did not know there had been issues with points theft in the past, or that there was an option to lock her account, saying this should be made more clear. <\/p>\n

Sainsbury\u2019s has refunded the couple\u2019s points after checking they were spent outside of their usual area, but sales assistant Amber said she is worried many customers wouldn\u2019t even realise they were victims, as they might assume their partner had spent the points on a linked account. <\/p>\n

She said the incident left her worried about how scammers got her details, and what else they may have accessed. <\/p>\n<\/p><\/div>\n<\/p><\/div>\n

The paper reported that scammers were selling account numbers online, although it\u2019s unclear how they accessed them in the first place. <\/p>\n

Sainsbury’s has not revealed how they think scammers are doing this, fearing that it could encourage more fraud if they do. <\/p>\n

Fariba, a 44-year-old professional placement advisor, said she struggled to resolve the loss of her points because her mum was the primary account holder, despite using the card \u2018for years\u2019 with her email address \u2013 a problem that others also reported to customer services reps. <\/p>\n

Eventually, she managed to resolve the issue and will be sent a new card with the lost points added to it.<\/p>\n

But she described the process as \u2018really pointless and a waste of my time\u2019, saying the experience made her concerned that criminals have her details. <\/p>\n

\n
\n
\n
\n\t\t\t\t\t\t\t\t\t\t{“@context”:”https:\/\/schema.org”,”@type”:”VideoObject”,”name”:”Metro.co.uk”,”duration”:”T25S”,”thumbnailUrl”:”https:\/\/i.dailymail.co.uk\/1s\/2025\/06\/02\/14\/98964797-0-image-a-19_1748871226056.jpg”,”uploadDate”:”2025-06-02T14:32:54+0100″,”description”:”Money Saving Expert share how to protect your Nectar points after people reported losing thousands of points.”,”contentUrl”:”https:\/\/videos.metro.co.uk\/video\/met\/2025\/06\/02\/8740821332583203742\/480x270_MP4_8740821332583203742.mp4″,”height”:480,”width”:270}<\/p>\n

\t\t\t\t\t

To view this video please enable JavaScript, and consider upgrading to a web
\n\t\t\t\t\t\t\tbrowser that
\n\t\t\t\t\t\t\tsupports HTML5
\n\t\t\t\t\t\t\t\tvideo<\/a><\/p>\n

\t\t\t\t\t<\/video>\n\t\t\t\t<\/div>\n

\n
\n
\n

Up Next<\/p>\n

\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/div>\n

\n
\n\t\t\t\t\t\t\t\tPrevious Page<\/title>\n\t\t\t\t\t\t\t<\/div>\n<div class=\"metro-related-video-carousel__page\"><\/div>\n<div class=\"metro-related-video-carousel__page\"><\/div>\n<div class=\"metro-related-video-carousel__page\"><\/div>\n<div class=\"metro-related-video-carousel__page\"><\/div>\n<div class=\"metro-related-video-carousel__arrow metro-related-video-carousel__arrow--right disabled\">\n\t\t\t\t\t\t\t\t<title>Next Page<\/title>\n\t\t\t\t\t\t\t<\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"metro-related-video-carousel__related-videos-placeholder\">\n<div class=\"metro-related-video-carousel__related-video-placeholder\">\n<div class=\"metro-related-video-carousel__related-video-placeholder-thumbnail\">\n\t\t\t\t\t\t\t<\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder-headline\">\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span>\n\t\t\t\t\t\t\t<\/div>\n<\/p><\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder\">\n<div class=\"metro-related-video-carousel__related-video-placeholder-thumbnail\">\n\t\t\t\t\t\t\t<\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder-headline\">\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span>\n\t\t\t\t\t\t\t<\/div>\n<\/p><\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder\">\n<div class=\"metro-related-video-carousel__related-video-placeholder-thumbnail\">\n\t\t\t\t\t\t\t<\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder-headline\">\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span>\n\t\t\t\t\t\t\t<\/div>\n<\/p><\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder\">\n<div class=\"metro-related-video-carousel__related-video-placeholder-thumbnail\">\n\t\t\t\t\t\t\t<\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder-headline\">\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span>\n\t\t\t\t\t\t\t<\/div>\n<\/p><\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder\">\n<div class=\"metro-related-video-carousel__related-video-placeholder-thumbnail\">\n\t\t\t\t\t\t\t<\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder-headline\">\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span>\n\t\t\t\t\t\t\t<\/div>\n<\/p><\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder\">\n<div class=\"metro-related-video-carousel__related-video-placeholder-thumbnail\">\n\t\t\t\t\t\t\t<\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder-headline\">\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span>\n\t\t\t\t\t\t\t<\/div>\n<\/p><\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder\">\n<div class=\"metro-related-video-carousel__related-video-placeholder-thumbnail\">\n\t\t\t\t\t\t\t<\/div>\n<div class=\"metro-related-video-carousel__related-video-placeholder-headline\">\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span><br \/>\n\t\t\t\t\t\t\t\t<span><\/span>\n\t\t\t\t\t\t\t<\/div>\n<\/p><\/div>\n<\/p><\/div>\n<p>\t\t\twindow.addEventListener(‘metroVideo:relatedVideosCarouselLoaded’, function(data) {<br \/>\n\t\t\t\tif (typeof(data.detail) === ‘undefined’ || typeof(data.detail.carousel) === ‘undefined’ || typeof(data.detail.carousel.el_) === ‘undefined’) {<br \/>\n\t\t\t\t\treturn;<br \/>\n\t\t\t\t}<br \/>\n\t\t\t\tvar player = data.detail.carousel.el_;<br \/>\n\t\t\t\tvar container = player.closest(‘.metro-video-player’);<br \/>\n\t\t\t\tvar placeholder = container.querySelector(‘.metro-video-player__up-next-placeholder’);<br \/>\n\t\t\t\tcontainer.removeChild(placeholder);<br \/>\n\t\t\t\tcontainer.classList.add(‘metro-video-player–related-videos-loaded’);<br \/>\n\t\t\t});<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<h2 class=\"wp-block-heading\">How are scammers able to steal Nectar points?<\/h2>\n<p>There are no ID checks to spend points, except at Argos when there are if the amount is over \u00a350. <\/p>\n<p>A loophole meant that anyone with a user\u2019s account number or barcode could potentially spend their points, unless the spend lock feature was turned on. <\/p>\n<p>Last year, Cian Heasley, Threat Lead at Adarma cyber security firm, told <strong>Metro<\/strong>: ‘The specific nature of this vulnerability hasn’t been disclosed, but it could be that the attackers are conducting a brute-force attack. In this type of attack, malicious individuals, either manually or through automation, attempt to log into a customer reward portal using randomly generated reward account numbers.<\/p>\n<p>‘When they do not receive a “no such user” or similar error message, they know the account is active and can generate a barcode scannable account identifier to spend the reward points.<\/p>\n<figure class=\"img-container shareable-item wp-caption\">\n<div class=\"img-wrap\">\n\t\t<img decoding=\"async\" width=\"646\" height=\"433\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"article-image wp-image-23308165 lazyload\" alt=\"Nectar points stolen\" loading=\"lazy\" data-src=\"https:\/\/mississaugaoffice.com\/wp-content\/uploads\/2025\/06\/SEI_254044920-8af6-e1748876463866.jpg\">\t<\/div><figcaption>People saw their points spent in places they have never been (Picture:X)<\/figcaption><\/figure>\n<figure class=\"img-container shareable-item wp-caption\">\n<div class=\"img-wrap\">\n\t\t<img decoding=\"async\" width=\"646\" height=\"175\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"article-image wp-image-23308111 lazyload\" alt=\"Nectar points stolen\" loading=\"lazy\" data-src=\"https:\/\/mississaugaoffice.com\/wp-content\/uploads\/2025\/06\/SEI_254045013-e1748876556917.jpg\">\t<\/div><figcaption>Shoppers have been asking if the app is working correctly (Picture: X)<\/figcaption><\/figure>\n<figure class=\"img-container shareable-item wp-caption\">\n<div class=\"img-wrap\">\n\t\t<img decoding=\"async\" width=\"646\" height=\"167\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" class=\"article-image wp-image-23308129 lazyload\" alt=\"Nectar points stolen\" loading=\"lazy\" data-src=\"https:\/\/mississaugaoffice.com\/wp-content\/uploads\/2025\/06\/SEI_254045083-f0a7-e1748876571323.jpg\">\t<\/div><figcaption>One customer said ‘I can’t even log in. I see others have the same issue. What’s going on?!’<\/figcaption><\/figure>\n<p>‘To defend against this attack, app developers should incorporate security measures into the app’s design. For instance, they should require a full login or identity authentication to spend points and ensure that login portals do not indicate whether accounts are valid or not. Limiting the number of login attempts before imposing a timeout can also slow down brute-force guessing attacks.<\/p>\n<p>\u2018The attackers may also be using credential stuffing, a cyber-attack where hackers use breached account information, like usernames and passwords, to gain unauthorised access to other online accounts. To protect against credential stuffing, it is crucial that individuals do not reuse passwords across different accounts, enable multifactor authentication whenever possible, and consider using a password manager to store and manage passwords for various apps and websites securely.\u2019<\/p>\n<p>A Nectar spokesperson said: ‘The security of our customer accounts is our highest priority and the proportion of those impacted by fraud each year is very small. <\/p>\n<p>‘We have a range of measures which detect and in many cases prevent fraud, including point spending confirmation emails and our Spend Lock feature.’<\/p>\n<p class=\"\"><strong><strong><strong>Get in touch with our news team by emailing us at <a rel=\"noreferrer noopener\" href=\"mailto:webnews@metro.co.uk\" target=\"_blank\">webnews@metro.co.uk<\/a>.<\/strong><\/strong><\/strong><\/p>\n<p class=\"\"><strong>For more stories like this, <\/strong><a rel=\"noreferrer noopener\" href=\"https:\/\/metro.co.uk\/news\/\" target=\"_blank\"><strong>check our news page<\/strong><\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Amber Shuker-Bright (left) and Fariba Rad (right) were among those affected Scammers are still having a shopping spree with stolen Nectar points, with shoppers seeing their accounts drained in places they have never visited.  Meanwhile, some say they have been locked out of their accounts entirely and have asked Sainsbury’s for an explanation.  The supermarket…<\/p>\n","protected":false},"author":1,"featured_media":566,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-564","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-featured"],"_links":{"self":[{"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/posts\/564","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/comments?post=564"}],"version-history":[{"count":3,"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/posts\/564\/revisions"}],"predecessor-version":[{"id":574,"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/posts\/564\/revisions\/574"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/media\/566"}],"wp:attachment":[{"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/media?parent=564"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/categories?post=564"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mississaugaoffice.com\/index.php\/wp-json\/wp\/v2\/tags?post=564"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}