Online scam sparks bank security scare

By BRIDGET CARTER

A sweeping review of internet banking security is being done after international criminals stole up to $100,000 from online customers.

Under new security measures being considered by banks throughout New Zealand, online customers may be given withdrawal restrictions, sent passwords through text messages and given security cards to allow them access to their bank accounts.

The move comes after banks were hit by an internet scam in which up to $100,000 was stolen from several customers.

Yesterday, police met Bank of NZ staff to discuss introducing a smart card for internet banking.

The card would carry information and would be needed for the computer to access account details.

BNZ spokesman Zaman Toleafoa said the meeting was an "information-sharing exercise" and the bank was keeping its options open.

The national manager of the police e-crime laboratory, Maarten Kleintjes, said the scam artists, operating from Estonia and Latvia, used fake identities and tricked customers into emailing their personal banking details.

People in New Zealand were then employed to send money into overseas accounts.

Those making the transactions thought they were working for a legitimate company.

They included a 72-year-old New Zealand man, who was trying to earn extra money for his retirement.

Mr Kleintjes said countries such as New Zealand and Australia, which had less-secure banking systems than European nations such as Finland, were targets of the scams.

Police would welcome any increase in bank security.

"New Zealanders love the internet," he said. "They love using computers and gadgets.

"The biggest issue is the confidence of the New Zealand public in the internet and other online services being provided."

Other banks looking at new security measures include ASB, Westpac and the National Bank. Some of the measures are:

A number sent to bank users through a text message each time they access an account. The number would be effective for only one use.

Daily withdrawal restrictions.

A scratch card, used in the Netherlands and Finland, which is like a lottery scratch card, carrying numbers needed to access an account.

Westpac spokesman Paul Gregory said Westpac was carefully considering a number of other security measures to protect its 360,000 internet banking customers.

"It would be irresponsible not to," Mr Gregory said.

"But we have to weigh up convenience. A lot of businesses do a lot of internet transactions each day."

Other banks spoken to by the Herald agreed that any new technology would have to be carefully balanced against cost and inconvenience to customers.

The ASB Bank's head of retail banking and marketing, Barbara Chapman, said "all sorts of stuff" was being looked at, but things such as "smart" cards could cost up to $125 each.

She said no ASB customers had been victims of the scam and the bank would have to carefully consider whether extra security measures would be worth it.

Consumers' Institute chief executive David Russell said he did not think banks were "crying wolf".

They kept just a few weeks ahead of the criminals and as soon as a new system was set up someone would try to crack it.

Extra protection for banking was a "sad inevitability", Mr Russell said.

When banks took a loss it was shared out among all customers.

"Systems create inconvenience for consumers, but they protect us," he said.

"I am afraid they are here to stay."

How the net fraudsters did it

Criminals from Estonia and Latvia send out emails posing as bank staff asking for individuals' access numbers and passwords.

The scam artists then hire people in New Zealand to use the passwords and withdraw money from these accounts, saying it is for a legitimate sales company.

The money is sent to the fraudsters overseas.

Those who withdraw the money are offered 5 per cent of the funds.

Police say up to $100,000 was stolen.