Another bug hits Auckland HOP card

Auckland HOP card.

Auckland Transport is urging HOP cardholders using a popular smartphone app to change their passwords after another bug struck the travel card.

The council body became aware of the problem when some credit card top-ups to AT HOP card accounts began stalling on the Kiwi Hub app.

The issue follows a bug that froze money on HOP cards for about 16,000 users. It led to balances disappearing if people topped the their card online and did not tag on within 60 days. That bug has now been fixed.

An AT spokesman said last month it noticed some credit card top-ups to AT HOP accounts were beginning to stall.

The top-ups were stalling meaning money wasn't going out of accounts - there was no security breach and no unauthorised transfers, he said.

"We became aware of an app that was launched at the end of August asking for transport information for people in Auckland, Wellington and Christchurch. It claimed to put all your information into one place but it did require your AT HOP log-in and password."

The terms and conditions for AT HOP are that users do not share this information - in the same way they do not share credit or debit card information.

The spokesman said AT believed about 15,000 AT HOP cardholders gave their account details to this third party app.

AT HOP Group general manager Denise Verrall said: "We are talking about a robot which was sending multiple requests within milliseconds, whereas a normal user would only be able to click a refresh button every three or four seconds."

She said the security of the AT HOP system was never breached as the app did not access cardholders' financial transactions. It was only seeking their journey information.

Auckland Transport has met the backers of the app and they have modified their systems so they are not bombarding AT with requests.

Verrall said customers should never to provide account details to third parties.