Police have today released photos of a man they suspect is responsible for the Wilson Parking card skimming operation affecting hospital ticket machines.
On Wednesday the Herald broke the news that ticket machines at Auckland and Waikato Hospitals had been linked to fraud on New Zealanders bank accounts by a card skimming operation.
The major banks alerted Wilson Parking to the fraudulent activity in June and a police investigation was launched on July 6.
Wilson Parking, which operates 500 parking ticket machines throughout the country, said it found no sign of a skimming device attached to the Auckland machine after the reports and it carried out an audit of all of its sites around the country.
While Wilson supplied the machine, equipment and some services for the Waikato Hospital car park, the company said the Waikato District Health Board operated and managed the site.
Card skimming involves cloning a bank card by copying its magnetic strip while a camera records a person entering their pin number, gaining access to a person's bank account.
While it is not a common form of fraud in this country (most scams occur online), the method is on the rise using equipment imported from overseas.
Netsafe figures show there were 119 reports of "misuse of financial identity" relating to bank cards, of which card skimming falls under, between July 2019 and June 2020.
Netsafe chief executive Martin Crocket said card skimming devices were discreet and could easily be attached to ATMs and merchant terminals, but this type of scam was not common, so many Kiwis were not aware of the risk.
Hundreds of New Zealanders' bank accounts have been affected by the fraudulent activity as a result of the hospital skimming operation. As a precaution, banks have cancelled cards and re-issued them.
The exact number of people who have had money taken from their accounts has not been disclosed.
Westpac told the Herald earlier in the week that it had replaced "several hundred" cards as a precaution and ASB said it was actively contacting its customers to ensure they were "not negatively impacted" by the fraudulent activity.
ANZ, Kiwibank and BNZ also confirmed their customers had been affected.
The incidents of fraudulent activity were reported to have taken place in May and June, police said, but there is a risk of continual fraudulent activity on a person's account once fraudsters have gained access to financial details. That is why banks cancel cards and reissue new ones.
As long a person does not willingly give out their bank details they are often covered by their banks and do not face the financial loss of any fraudulent activity on their accounts.
Detective senior sergeant Nikki Latimer, of the Auckland City financial crime unit, said the police were appealing to the public to help identify the man in relation to the operation, captured on CCTV on the grounds of Waikato DHB.
"Over the past month, police have received multiple reports relating to card skimming incidents involving Wilson Parking machines at both Auckland and Waikato Hospitals," Latimer said.
"The incidents are reported to have taken place in May and June after the victims noticed amounts unknowingly taken out of their bank accounts after using the parking machine."
Police said the investigation is in its early stages and it was not yet known if more than one person was involved in the scam.
Wilson declined an interview with the Herald earlier in the week, instead it issued a statement explaining it was first alerted to skimming linked to ticket machines by ANZ on June 29.
The company said it worked "quickly" after being notified of the breaches and undertook a full audit of its 500 machines "within 48 hours of receiving the advice".
"This breach is suspected to have impacted only one machine within the Wilson Parking portfolio, and for a short period of time," a spokeswoman said, referring to the Auckland Hospital machine.
"Upon receiving the notification from ANZ, we conducted a physical check of the machine in question and quickly confirmed there was no external skimming device attached to the machine.
"Importantly, there was at no point any data breaches impacting the software system. Further, we undertook an audit over and above our regular scheduled checks of all our machines within 48 hours of receiving this advice," the company said in a statement.
A spokeswoman said Wilson had co-operated fully with ANZ and police investigations to review CCTV footage and would continue to conduct regular checks of payment machines.
The firm continuously upgraded its software to ensure customer data was fully protected by using secure encryption, Wilson said.
Contactless payments reduced the opportunity for fraudsters to obtain card data, an ANZ spokesman said.
Kiwibank said both of the hospital machines had been identified as "compromise points".
The locations could have been targeted as they were busy places and people were often in a rush in these facilities.
Wilson said it was pleased that the police investigation had "made progress in identifying a suspect for crimes towards Wilson Parking and its customers".
What you can do
• Anyone with information about the man captured on CCTV on the grounds of Waikato DHB is asked to contact police on 105, quoting file number 200706/8833.
• Anyone with information can also contact Crimestoppers anonymously on 0800 555 111.
• Anyone who believes they have been a victim of card skimming should notify their bank immediately and report it to police by phoning 105.