Police have swooped on a gang thought to be behind a sophisticated eftpos card-skimming operation in which dozens of people have lost thousands of dollars.
Four people are expected to face court today in connection with the latest scam targeting New Zealanders' bank cards - this time involving store eftpos machines.
Thousands of dollars was withdrawn from at least 60 BNZ and Westpac accounts via a cash machine in Canada at the weekend. Other banks' customers, including the ASB's, have also been affected.
The scam is separate from one that targeted five ANZ and National Bank ATMs in Auckland in February and March, when more than $1 million was taken by fraudsters who withdrew the money in cities around the world.
In those cases, a "skimming" device was fitted over the slot where the card was inserted into the ATM. Information was collected from the card's magnetic strip while a tiny camera fitted above the keypad recorded the PIN being entered.
However, the Herald understands latest cases have targeted eftpos terminals inside stores - possibly by replacing them with machines with devices fitted or by tampering with them in store.
It is understood four people were arrested in Auckland on Friday evening and are set to appear in court today.
About 60 customers from BNZ and Westpac were affected at the weekend. Eftpos, credit cards and debit cards had all been used, the banks said.
People affected have had their bank accounts frozen and will have to have new cards issued. They will be reimbursed for any money that has been taken.
EMPLOYEES TARGET EFTPOS USERS
Centre for banking studies at Massey University Dr Claire Matthews said the new eftpos card scam targeting eftpos machines would be employees taking details through a separate device.
"It is less likely to be the terminal itself, but an employee who is taking the card at the same time you're making the transaction and taking the details on a separate device.''
She said scams were diversifying all the time and it was a matter of protecting your personal identification number (PIN).
"It's important to take care when entering your PIN, because even if they've got the details of the card they still need the PIN and that's why the advice is to actually to cover your hand as you enter your PIN,'' Matthews told Newstalk ZB this morning.
"Some terminals have a PIN cover, but they're uncommon and if you don't have one of those you should be covering your PIN.''
Matthews said New Zealand was up to speed with technology, but once new forms of scamming were discovered the information would be shared widely and internationally.
"It's a cat and mouse game. As soon as one is prevented those interested find another way of doing it,'' she said.
She said when money had been illegally taken from an account and the owner had not contributed in any way to the loss the onus would be on the bank.
"The bank are the ones that bear the loss. If you haven't contributed to the loss in any way the bank will reimburse you.''
SKIMMING ON THE INCREASE - ASB
ASB said it had noticed an increase in "skimming" scams over the past several days, which was impacting all banks.
"We have identified the cards that were used during the dates when potential fraud issues have occurred and will be speaking with our affected customers."
One scam victim, Justin Bennett, told a news website yesterday that his BNZ account was "emptied" with several transactions of $350. A statement showed the transactions were made in Canada.
His girlfriend, Natasha Young, reportedly had her account frozen by Westpac after attempts were made overseas to access it.
No arrests have been made in relation to the earlier ATM skimming but police released a picture of a man seen near the affected machines.
Bill Farmer, chief executive of credit card security business Mako Networks, said much of the focus on card fraud was usually to do with ATM machines, but criminals regularly "harvested" information from other locations.
"They could have people who are working in the individual businesses - particularly the hospitality trade - and they basically take the credit card or debit card and get the information off it through a separate reader."
He said it was essential businesses complied with a new security system that was being quickly adopted in the Northern Hemisphere and is likely to be compulsory worldwide by 2015.
Mr Farmer said local businesses had been slow to comply. Of an estimated 180,000 merchants in New Zealand, he would be "surprised if there were 1000 of them compliant" with the new standard.
In July 2010, two Canadians admitted their part in an international syndicate that secretly modified eftpos machines in NZ shops to steal customers' card details.
The skimmers replaced eftpos terminals with "compromised" replicas, often aided by shop staff they had bribed or threatened.
- additional reporting: Amelia WadeBy Andrew Koubaridis @A_Koubaridis Email Andrew