Scam-A-Lot

Technology provides convenience. But we often forget that technology also exposes vulnerabilities that we never had to think about in the traditional parking business model. A recent parking-related scam uncovers one major challenge of automated parking technologies.

In November, a scam was uncovered relating to Auckland's Downtown parking lot. The media speculates that thieves hacked into the car park's automated credit card payment system and used cardholder data
to replicate cards and make unauthorized charges. More than 100,000 credit cards are expected to be reissued.

The PCI Security Standards Council, which is made up of the world's largest credit card companies, has developed the PCI DSS standards to direct merchants on how to protect cardholder data. Although these standards are popular in the US, they are only recently becoming adopted internationally. This recent occurrence proves just how important these standards may be to the international parking community.

I have been trying to find out whether Auckland's Downtown car park, which is owned and operated by the Auckland City Council, was compliant with PCI DSS. But both the Auckland City Council and its acquiring bank, Westpac New Zealand, have said they cannot comment on this while the incident is still under investigation. Until we hear more information from these organizations, I am tempted to assume that there was no PCI DSS compliance with the Downtown car park's automated credit card payment system.

Dale Clements, Group Manager Parking, Transport, Auckland City Council, says they are looking at options for updating the card acceptance systems across all car parks. Hopefully, the Auckland City Council is looking for a new system that is compliant with the latest PCI DSS guidelines.

Our industry has grown into a multi-billion dollar market, and parking payment kiosks can contain as much valuable financial information as an ATM. The Auckland incident is a sobering reminder that security of cardholder data must be a top priority for any car park owner or operator.

Pete Goldin