Shoppers who own and use Tesco Clubcards are being urged to check their accounts by the supermarket.
The warning comes after Tesco discovered that fraudsters had been misusing the system to steal points for use on Hotels.com.
Scammers had been stealing codes for the hotel booking website and selling them online.
The Express reports how cybercriminals were able to decipher the 13-digit codes, which were generated by Hotels.com, in order to claim the discount when booking online.
As well as affecting Hotels.com, the scam also affects loyal Clubcard holders, as codes are single-use only.
If a code has been guessed and used, shoppers will not be able to use it again.
Tesco has now pulled the voucher from its website.
All of the Clubcard customers who have been affected should have now received replacement vouchers or had Clubcard points reimbursed.
Any shoppers who suspect they have codes that have been used should contact the Clubcard support team if they’ve not already been contacted.
Cyber security group CyberNews, which discovered the scam in March of this year, says: "In the current economic climate people are looking for ways to save money, so businesses need to stay vigilant to prevent fraud.
"We’d recommend using longer, less predictable discount codes with more characters which make it harder for cybercriminals to predict, as well as implementing a limit on attempts for an incorrect entry to prevent brute force attacks of this nature."
A Hotels.com spokesperson said: "This issue was identified and resolved promptly several months ago.
"Working closely with our partners at Tesco we ensured that only legitimate Clubcard customers were able to obtain and redeem the codes they had earned.
"No customers of Hotels.com or Tesco missed out on the offer, lost money or Clubcard points as a result."
