Carpark scam keeps banks busy

Tony Wai's card details were used fraudulently to buy goods worth $900 in Arizona. Photo / Richard Robinson

More than 100,000 credit cards may be replaced as a result of thieves hacking into payment machines at the Downtown carpark in central Auckland.

Auckland IT consultant Steven Ellis yesterday said service desk staff at ASB Bank told him that his new credit card was one of more than 100,000 Mastercard and Visa cards banks were replacing because of the scam.

Last night, Bankers' Association chief executive Sarah Mehrtens said everyone who used a credit card or debit card at the Auckland City Council-owned carpark would have it replaced.

She said she did not know how many people were affected.

ASB, Westpac Bank - which is investigating the fraud - Mastercard and Visa are refusing to reveal the scale of the problem.

"Under the code of banking practice, cardholders should feel assured that they will not be held liable for fraud of the nature that has occurred in this instance," Ms Mehrtens said.

"Banks are taking appropriate action, including the re-issuing of cards, which effectively shuts down the opportunity for misuse of information."

The matter came to light after banking systems identified the council-owned carpark as a common point of purchase on fraudulent card transactions.

About 10,000 people a week use the 1970-space carpark.

It is not known whether the thieves attached a skimming device to the payment machines or gained access to the devices' credit-card database internally.

If the access was internal, those responsible could be overseas.

Two people contacted the Herald yesterday to say their credit cards had been fraudulently used at Walmart in the American city of Phoenix, Arizona, after being used at the Downtown carpark.

Tony Wai, who runs the professional recruitment company Crackerjacks, said the ASB was quick to credit back the $900 worth of goods bought at Walmart and replace his personal card.

Information technology security expert and forensic investigator Daniel Ayres said the ASB replaced his Visa card yesterday because of a "heightened risk of fraud".

Mr Ayres said he doubted thieves would have used a skimming device because of a number of security cameras in the building.

He suspected they used some kind of electronic method or information printed on receipts to obtain credit card details.

Council finance general manager Andrew McKenzie said he understood credit card information was not kept on the machines, but did not know if it was kept on another council computer.

He said the council adjusted the machines to current security standards. Security issues formed part of Westpac's investigation.

"When we know we will close down the avenue," Mr McKenzie said.

In the meantime, the council has stopped accepting payment through the machine credit-card facilities at the Downtown carpark and the Victoria St and Aotea carparks, which also have credit-card facilities.