KEY POINTS:
One of 980 motorists who sent banking details across an insecure link to a toll road website says he was misled into believing it was secure.
Richard Godman says he opened an account for the Northern Gateway motorway between Orewa and Puhoi only after receiving a security assurance
from the Transport Agency on Christmas Eve.
The agency shut the online payment section of its website on Tuesday, admitting it was set up "without all the necessary security features".
That was despite confidence expressed to the Herald by a senior agency official on Monday that it was secure, as its banking arrangements had been "verified and certified" by banks involved with the website.
Computer experts have complained at having their concerns about the website brushed off by the agency, which intends introducing tolls of $2 for each car trip and $4 for trucks when the $365 million motorway opens on January 25 - the Sunday of Auckland Anniversary Weekend.
But Mr Godman, an Auckland insurance manager, queried the lack of website security features as long ago as December 23.
The agency assured him the next day its transaction centre was "a secure payment site and your credit card details will be kept strictly confidential".
Centre staff told him they had asked for a statement to be added to the website to confirm to motorists that it was secure.
Mr Godman said he took them at their word and completed his online application using his credit card.
"I will be taking them to task should I notice any unlawful use of my credit card."
The agency says it has begun contacting all those who sent credit card details to the website, but others can still phone its call centre at 0800-40-20-20 to set up accounts.
A spokesman said last night the agency did not know the site was insecure when it gave its assurance to Mr Goodman, and it regretted giving him incorrect information.
The agency did not know of any unauthorised transactions, but would work with customers and their banks for a satisfactory resolution should any problems emerge.
Both credit card companies involved with the website, Visa and Mastercard, have said motorists will not have to pay for any unauthorised transactions if conditions of "zero liability" policies are met.
One motorist said he had received a credit card bill including a $44 payment to the agency as a deposit for registering his car with the toll road.
He called on the agency to allow motorists to use the road free from its opening date if it was unable to fix its collection system by then. But the spokesman said the agency was working hard to add security features to the website, and the phone payment facility remained available.
Another motorist, Terry Moverley, decided against setting up an account after entering the registration number for his grey-blue Holden Commodore and being told by the website that it was gold-coloured.
"I backed off, thinking there was something dodgy in the system."
Telecommunications Users Association chief Ernie Newman is pleased the agency is fixing the security flaws but disappointed at the high deposit, which would have been $48 in his case, for two vehicles.
"The result is that some people like me, who will probably take between one and two years to use that amount of credit, will just pay journey by journey - and that's not in their [the agency's] interests or the customers'."
Although the Government has approved a $40 infringement fee for motorists who fail to pay within 28 days, the agency has yet to confirm an administration charge potentially payable after three days. A proposed added fee of $5 remains under review.
