Wilson Parking operates 500 parking ticket machines across the country. Photo / Sylvie Whinray
Wilson Parking operates 500 parking ticket machines across the country. Photo / Sylvie Whinray
Banks have alerted Wilson Parking to card skimming fraud at machines in two hospital car parks.
Wilson Parking New Zealand, which operates 500 parking ticket machines throughout the country, says ANZ alerted it to fraud relating to ticket machines at Auckland Hospital and Waikato Hospital at the end of June.
"This breach is suspected to have impacted only one machine within the Wilson Parking portfolio, and for a short period of time," a spokeswoman said, referring to the Auckland machine.
Wilson says it found no sign of skimming devices when it inspected its machines throughout the country.
The company supplies the equipment and some services to the Waikato District Health Board site but doesn't operate the carpark. The board is the operator and manager.
The Police confirmed to the Herald that claims of card skimming at both machine locations were now the subject of an investigation.
Card skimming involves cloning a bank card by copying its magnetic strip while a camera records a person entering their pin number, gaining access to a person's bank account.
While it is not a common form of fraud in this country - most scams occur online, the method is on the rise, with the equipment imported from overseas.
Hundreds of New Zealanders' accounts have been affected by the hospitals' scam and as a precaution the banks have cancelled cards and re-issued them.
The exact number of people who have had money taken from their accounts as a result has not been disclosed.
Wilson said it had worked "quickly" after being notified and had found no external skimming device attached to its Auckland Hospital machine. It did a full audit of its 500 machines "within 48 hours of receiving advice" from ANZ.
"There is no evidence of external skimming devices at any of the 500 payment machines managed and monitored by Wilson Parking across New Zealand," she said.
"Upon receiving the notification from ANZ, we conducted a physical check of the machine in question and quickly confirmed there was no external skimming device attached to the machine.
"Importantly, there was at no point any data breaches impacting the software system. Further, we undertook an audit over and above our regular scheduled checks of all our machines within 48 hours of receiving this advice," the company said in a statement.
The spokeswoman said Wilson had co-operated fully with ANZ and police investigations to review CCTV footage and will continue to conduct regular checks of payment machines.
The Police is investigating card skimming reports about Auckland and Waikato Hospitals' ticket machines. Photo / Dean Purcell
The firm continuously upgraded software to ensure customer data was fully protected by using secure encryption, Wilson said.
A Waikato DHB spokeswoman confirmed it had been "notified of an attempt to obtain debit and credit card details of people using parking machines at a number of locations including Waikato Hospital car parks".
She said the matter was currently under Police investigation and it could not comment further.
The police have been contacted for comment.
A spokesperson for Kiwibank said the hospital machines had been identified as "compromise points".
"The banks have been quick to notify the carparking company, who we understand are now displaying warning signs on their machines," Kiwibank said.
New Zealand's largest bank, ANZ, said some of its customers had money taken from their accounts as a result of the breach.
"They were identified by our systems and we worked with them to secure or replace their cards, and we reimbursed the money taken.''
Contactless payments reduced the opportunity for fraudsters to obtain card data, the ANZ spokesman said.
CARD SKIMMING NOTICE: We have been notified of an attempt to obtain debit and credit card details of people using...
BNZ also confirmed that its customers had been affected by skimming at the machines.
"We recommend customers contact their bank immediately if they notice any suspicious or unauthorised transactions or if they observe any signs of tampering on a machine they are using. Things to look out for include substances like glue or scratching on an ATM or merchant terminal."
Westpac said it was also aware of the two Wilson car park locations that had been affected by card skimming operations, and had replaced several hundred cards as a precaution.
ASB confirmed that some of its customers had been affected by the skimming operations and that it was actively contacting them to ensure they were "not negatively impacted" by the fraudulent activity.
Wilson Parking declined an interview with the Herald.
Netsafe chief executive Martin Crocker said card skimming devices were discreet and could easily be attached to merchant terminals and ATMs, but this physical scam was not common here.
"I don't think many New Zealanders would be thinking about it as they should as they go about their day using their cards."
Netsafe reported a 10 per cent increase in online scams, mostly due to a pick-up in fraudulent Covid-19 schemes, during lockdown.
