First published: 08th March 2012
In the first case of its kind, a technician and his family have been arrested for allegedly defrauding MTR Corp and Octopus Cards of HK$430,000. The Octopus card is a contactless smartcard commonly used for payments on public transport and retail outlets in Hong Kong. The technician arrested formerly worked for a contractor responsible for maintaining the Octopus card readers. It is alleged that he stole card reader parts from a storeroom, later assembled a working add-value machine that could accept banknotes at his home and family members assisted in using the cards to purchase items that could be resold.
The fraud was detected from company records that revealed value being added to cards by a machine that was not on the Octopus network. Police then investigated people employed by MTR Corp or its contractors who had access to add value machines. Superintendent Glenn O'Neill said, "Creating an add-value machine requires insider technology or high-level technical expertise."
Yui Kee's Chief Consultant, Allan Dyer commented, "This shows the value of defence in depth and audits. The technical features of the card and the payment system make changing the value on the card without an authorised reader almost impossible, but here an authorised reader was stolen, bit by bit. The reconciliation of records revealed the crime, and the access restrictions on equipment limited the personnel that the Police needed to investigate."