HiCaps and Tyro terminals used by doctors and dentists to rebate Medicare and insurance claims seized by crooks in Victoria

First it was tennis racquets and soccer balls, then it was black market meat. Now, Victoria’s organised crime gangs are breaking into clinics and pushing fraudulent claims through Medicare and private health rebate terminals.

MELBOURNE, AUSTRALIA - The Australian Photos October 9, 2025: Nick Rhodes is a doctor at St Kilda East medical practice Clarity Medical. They were recently targeted by criminal gangs who stole the payments terminals to use them to make $30,000 of fake medicare refunds. His is one of several practices that have been targeted by crooks looking to make fake refunds. The practice is now locking up its machines in a bid to defeat the crooks. Picture: The Australian / Nadir Kinani

Melbourne’s crime wave has frustrated the city’s doctors and dentists as organised crooks exploit vulnerabilities in the healthcare billing system to process fraudulent refunds and rebates using stolen payments terminals.

A smash and grab spree has pilfered tens of thousands of dollars from doctors and allied health professionals stealing ubiquitous Tyro and HiCaps plug-in machines.

The terminals, which are used by patients at the point-of-sale to claim their entitlements from Medicare and private health insurers, are being misappropriated by fraudsters. But instead of ripping off the taxpayer or insurer, they are using the machines to break in to the practice’s float and steal idle funds undetected.

ASX-listed payments player Tyro, relied on by most bulk-billing doctors, told The Australian it was aware of at least seven medical practices whose machines were targeted. Tyro machines are integrated with the EasyClaim system and pay rebates directly to patient accounts to save them the hassle of manual claims processing.

But criminals have figured out Tyro’s terminals can be weaponised to process refunds for treatment that never happened, and skim the clinic’s accounts.

Melbourne doctor Nick Rhodes said he and several others clinicians at his practice were targeted. Dr Rhodes said the crooks stole from each of the doctors at his practice, running into the tens of thousands.

“It’s very targeted and organised,” Dr Rhodes said. “They’d cased the building well before they came in.”

The St Kilda East doctor said the clinic’s video footage captured the late night attack where a group arrived cloaked in gloves, masks and hats, approaching from the rear of the building after removing the yard’s gates. They approached the door with a crowbar, smashing the entry and snatching the Tyro machines off the front desk.

By early morning, thousands of dollars had been siphoned from the practice.

“We don’t know how they got into the machines, the PIN wasn’t written down anywhere,” Dr Rhodes said.

A Tyro Payments terminal.

The doctor said he couldn’t understand why Tyro had allowed the machines to process a swath of high value refunds before the practice’s opening hours.

Dr Rhodes said the clinic put blocks on its accounts the morning of the break in, but by then it was already too late. At least 21 fake rebates had been made and thousands of dollars were missing from the practice. Tyro has since agreed to refund the stolen money.

Dr Rhodes said his practice would retain its Tyro terminals, pointing out the company, led by Jonathan Davey, was the only operator that allowed instant patient rebates that assisted affordability. However, the blocks put in place after the robbery frustrated operations.

Tyro Payments CEO Jon Davey

“Our Tyro machines are now locked in a safe and can’t be taken. The PIN is only known to one person,” Dr Rhodes said.

His practice and the several others which reported the robberies to Victoria Police have failed to land any charges.

Victoria’s Crime Statistics Agency has reported a 16.3 per cent jump in criminal incidents per 100,000 people. Incidents of theft were up almost 28 per cent year-on-year, from 192,479 incidents in 2024 to 246,654 matters in 2025.

A Victoria Police spokeswoman confirmed it was investigating “a small number of incidents where a medical facility has been targeted by unknown thieves and the payment terminal has been taken”.

“Investigators are working to determine if these incidents are linked,” she said. “As these investigations are in their infancy, it would not be appropriate to comment further at this time.”

A Tyro spokeswoman said the company was aware of at least seven medical practices where its terminals were stolen and used to process fraudulent transactions and this was worst “specifically in Victoria”.

“Once alerted to the issue, Tyro deployed additional fraud and risk controls, supported police investigations, and ensured affected merchants were not financially impacted,” she said.

“To help reduce the risk of fraud, merchants are reminded to follow security advice, secure payment terminals when unattended, and use strong device passwords.”

Melbourne dentist Roman Pinkus said his dental clinic was hit on Sunday morning, which was the second time crooks have snatched the HiCaps private health co-payment terminal from his practice in weeks.

The HiCaps terminals are provided by National Australia Bank, which owns the operation used to process private health rebates for customers.

Dr Pinkus said he learned the criminals had claimed more than $8000 in rebates in the hours after stealing the machines weeks ago. But he was concerned about new fake rebates after another break-in.

A key vulnerability in the HiCaps machines is the default passcodes supplied with the terminal. Dr Pinkus said HiCaps had refunded $2000 of the missing $8000, but the shortfall remained outstanding.

“The rest is gone,” he said. “I would have thought it would be easy to get the money back. Last week I found out that’s not the case.”

Dr Pinkus was aware several other local dental practices had been targeted in the days surrounding the break-in at his St Kilda site.

Australian Dental Association president Chris Sanzaro confirmed that a number of dental practices had been hit by criminals seeking to steal terminals.

Dr Sanzaro said these attacks were adding “another layer of difficulty and cost for practices as they have to cancel appointments, clear up the mess, and make insurance claims”.

“Patients can rest assured their bank or credit card details are not stored in HiCaps machines and are therefore not compromised or stolen,” he said.

HiCaps owner NAB expressed its concern about “terminal takeover”. NAB group investigations executive Chris Sheehan said businesses should report these incidents to police.

He said NAB had “several controls in place to help stop the crime and work with customers if they are impacted”.

“This can include sharing information with law enforcement,” he said. “Education remains vital to stopping the crime as these transnational, organised criminals will always find new ways to rip businesses off.”

Victoria Police declined further comment.

Victorian medical receptionist Sarah Ward, from Clyde North, was sentenced to two years jail in 2023 over more than $181,000 in fake Medicare rebates.

Queensland Police also busted a 38-year-old man in November last year, alleging he had fraudulently claimed $670,000 in refunds and rebates after targeting Brisbane medical businesses.