Sainsbury has dismissed suggestions that its shopping web site is “so easy” to break into that someone with “an interest in crosswords and wordgames” can crack open accounts.
Fears about the retailer’s Sainsbury’s to You online delivery service have been raised after one user claimed in The Guardian they were able to easily access “a number” of accounts by guessing passwords.
A loophole in Sainsbury’s system allegedly allows users claiming to have forgotten a password to see hints on screen and then guess the right answer. Once in, they can change a person’s address to have any groceries sent elsewhere.
Most shopping sites send forgotten passwords to a
registered e-mail address, cutting back on the chance of fraud, although one saving grace for Sainsbury is that only the last five digits of any credit card numbers stored against accounts are shown once a user is in.
Sainsbury denied there was any problem and there had so far been no instances of fraud.
Its online service was previously the victim of a costly loophole at the end of last year when online shoppers were were swapping codes for £10-off vouchers online in order to use them again and again.
Simon Mowbray

Topics