Re: Hey, At Least Tesco Refunded The Money
If the transactions were card based ones, especially card not present which seems most likely, there are strict rules established by the card schemes (VISA, MasterCard) which govern liability and chargeback.
Despite what the media are saying, it's possible that the £2.5M supposedly lost by Tesco Bank will actually get eaten by the merchants or their acquirers, not by Tesco Bank. This is why there is a push to move the EMV standards globally for card transactions to shift the liability away from the merchant. Using 3DSecure for Card Not Present transactions also shifts the liability, so it will be interesting to see what kind of transactions were actually used in the Tesco Bank breach.