Student given someone else's Kiwisaver details

A university student trying to get information on her Kiwisaver balance was shocked to find ANZ had emailed her another person's details.

Cantabrian Sarfia Sparks, 19, filled out an online survey to find out how much more money she needed to contribute in order to get the maximum government tax credit to her savings scheme.

The automatic response email showed the name, investor number, and minimum contribution figure of a different customer. Thinking she had filled in the wrong details, she tested it using her mother's investor number.

It once again sent her mother the details of someone else. The name was so unique they could be easily identified, she said.

The Otago University student was concerned it was insecure, and too easy to "hack" into another person's details.

"It's a flaw in their system that needs to be altered, maybe with an extra security question. I just think it's too easy for someone to figure out how much you earn. How many other people have got the wrong information?"

An ANZ spokesman told The Press there was no sensitive information in the email and nothing that identified a customer or revealed their financial situation.

Based on the complaint, ANZ was making enhancements to exclude surnames from emails.

The Press