Solving stuff: The mysterious $15k fuel card fraud Z Energy wouldn't refund
Tuesday, 5 May 2026
Solving stuff is where we investigate reader complaints and push for answers. You can read more about the project here, and submit ideas at the end of the story.
In this instalment: Two couples had their fuel cards in their pockets in Wellington, yet almost $15,000 was spent on cigarettes, fuel and food in Auckland. Z Energy initially refused to pay, but as Natalie Akoorie reports, the company made a U-turn after Stuff enquiries - with a catch.
The owners of a small business have won a fight to recoup thousands of dollars spent on their company fuel cards in a fraud they say almost cost them the business.
Z Energy made a confidential offer to reimburse some or all of the money following questions from Stuff, two years after the fuel company declined to refund the $14,715.
The business owners said they believed Z’s online business fuel card portal wasn’t secure while Z said in light of the case it had now strengthened its systems and processes.
Z investigated the 2024 spending spree and concluded in August that year responsibility for the “fraudulent transactions” lay with the account holder, a small lower North Island business owned and operated by two couples.
However, one of the owners approached Solving Stuff for help in late April.
After we sent questions to Z Energy on April 24 the fuel company went directly to the business owners and, in contrast to its earlier decision, offered to reimburse them.
But only on condition that any settlement was confidential.
The saga began on May 20, 2024, when unbeknownst to the couples, two Z fuel cards in the business’ name were used to spend up large across Auckland.
A list of 102 transactions made between 12.56pm on May 20 and 2.42am on May 21, shows the two cards were used at 21 Z Energy and Caltex service stations across south and west Auckland.
At one Manurewa Caltex station alone one of the cards was used to buy five packets of cigarettes and the other six packets, at two different times of the night, totalling $854.50.
Almost $9500 was spent on 45 purchases of cigarettes alone, including 189 packets or cigarette-related products.
In less than 12 hours the splurge netted thousands more in petrol, diesel and food.
When the owners saw the list of transactions they were dumbfounded.
How could their cards be used in the middle of the night in Auckland, while they still had them safely at home in Wellington and Wairarapa?
“We had the physical cards the entire time. They were never lost, lent out, or out of our possession.”
The owners later discovered the purchases were made after someone logged into their account in the early hours of May 20 and reset the PINs, removed all spending limits and enabled purchases of all products, including cigarettes.
Before the credit limit removal, one card had a daily limit of $150 and a monthly limit of $700, and the other a monthly limit of $1500.
The owners said Z had been unable to explain where the login came from, or supply an IP address or device information.
There was also no explanation as to how the bogus cards were created and linked to the account.
“ I believe they (Z Energy) have a vulnerability in their system that we should not be responsible for,” one of the owners said.
The owners were alerted to the fraud the next day by Z who said in an email, seen by Stuff, their account had been suspended for reaching a credit limit of $3500.
In the email conversation that ensued one of the owners said she was concerned there had been a hack, and a Z staff member recommended they lodge a complaint with police.
Of the 102 transactions, Z supplied CCTV footage of three, partly “due to the technical complexity associated with the extraction” of it.
On June 7, 2024, an officer from the Counties Manukau Police financial investigations team wrote that fuel card fraud was becoming more commonplace.
The officer said he would“send out” the images to try to identify the suspects and attempt to liaise with Z to gather all the CCTV footage.
Counties Manukau CIB Detective Inspector Shaun Vickers told Stuff no arrests were made in the case and the file remained open.
“Fraud offending is often complex, and at this stage it has not been determined how this offending has taken place.”
Police did not have specific statistics for fuel card fraud.
On August 1, 2024 Z Business Operations emailed the customer saying it had “reviewed the case and declined to credit the fraudulent transactions”.
Z noted 61 suspicious transactions and that prior to the “fraudulent transacting, the perpetrator/s logged into Z’s online card management portal ZBOL” at 4.46am on May 20, using an email address for another director of the business.
(The owners told Stuff they checked with their email provider and were told the account used to log in had not been hacked into.)
The Z email went on to say customers were responsible for the security of their logins and that it was outside of Z’s control.
“Our Z Business Online Terms and Conditions, Section 4: Login ID and Password, state that ‘you will be liable for all activities carried out on ZBOL using your login ID and password, and any charges incurred as a result of these activities’.”
The decision was “final”, leaving the owners frustrated and disappointed.
“We felt they blamed us, for lending out cards - even though we provided evidence they were still in our possession - or that one of us had ripped the other off. It was offensive.”
The couples told Stuff they had known each other 20 years and had been in business - together with the third director who recently retired - since 2013 and that they all trusted each other implicitly.
They called the situation “incredibly stressful”.
“We’re a small business. A $15,000 hit is not something you just absorb. It affects cash flow, decisions, everything.
“Losses like this can easily be the thing that tips someone over.”
They criticised Z’s investigation claiming key questions were left unanswered.
“We don’t think it’s reasonable that someone accessed our account, removed all safeguards, spent nearly $15k, and we’re left carrying that loss without any clear explanation of how that access occurred.
“We know we did nothing wrong.”
Stuff emailed Z a detailed list of questions including why the business had to pay for the “fraudulent transactions”, and pointed to a Reddit thread posted three months ago outlining an almost identical case in which that customer claimed to have been reimbursed.
Stuff also asked whether there could be a security breach within Z Business’ online portal, after a previous Stuff Circuit investigation revealed there was a vulnerability in the same portal in late 2017, allowing unauthorised access to private details and business accounts.
We also asked if the portal required multi-factor authentication, and how it was possible for the two cards to be used in Auckland while the owners had theirs in Wellington and Wairarapa.
Before responding Z contacted the owners and offered to reimburse them in a confidential arrangement.
The business owners then withdrew from further involvement in this story.
A Z Energy spokesperson told Stuff after reviewing the matter and “taking into account additional information that has come to light over time”, it was working to resolve the issue directly with the customer.
“We have also used this experience to strengthen our systems, processes, and the way we support our customers,” the spokesperson said.
“We understand the concern situations like this can cause, and we want to reassure customers that Z Energy treats any allegations of fraudulent use of Z Business fuel cards extremely seriously.”
He said Z worked closely with police and actively supported investigations as they progressed.
“We encourage any Z Business customer who notices suspicious activity on their account to contact us as soon as possible so we can take prompt and appropriate action.”
Stuff put further questions to Z about its offer, whether it accepted the situation was caused by a fault in their system, whether it mishandled the situation, or if it had apologised.
In an email the spokesperson said: “We have no further comment to make. As you can appreciate, terms of any settlement agreement are confidential”.
The New Standard: If it’s unfair to you, it’s fair game for us.
Use the form below to tell us who is giving you the runaround. Or email natalie.akoorie@stuffdigital.co.nz