Phishing is the message that pretends to be someone you trust — your bank, NZ Post, Inland Revenue, the toll road operator — to get a password, a card number or a payment out of you. It is the most common way New Zealanders lose money online, and it works on careful people, not just careless ones.
This guide covers the scams circulating here right now, the specific signs that give them away, and exactly where to report each type.
How big the problem is
The National Cyber Security Centre recorded 1,129 incident reports in the April to June 2026 quarter with $2.7 million in direct losses reported, following 1,164 reports and $5.6 million the quarter before. Scams and fraud were the largest single category. Payments NZ put total fraud across a twelve-month period at $265 million, about $126 million of it from payments people were tricked into authorising themselves.
Those are only the reported figures. Most phishing goes unreported because the target spots it in time — or is too embarrassed to say anything.
The scams running in New Zealand
| Scam | What it claims | The giveaway |
|---|---|---|
| NZ Post parcel | A delivery needs a small fee or an address confirmation | NZ Post never asks for personal or financial details by text or email, and never texts from overseas numbers |
| Inland Revenue refund | You are owed a refund, click to claim it | IRD never sends links or refund amounts, never asks for your password, and texts only from 5678 or 4478 |
| Toll road or fine | An unpaid toll must be settled today | Urgency plus a payment link; real notices arrive by post or through the official account |
| Bank impersonation | Suspicious activity — call this number or move your money to a “safe account” | No bank asks you to move money to another account, ever |
| Investment and crypto | Guaranteed returns, often with a celebrity endorsement | Check the Financial Markets Authority warning list and the Financial Service Providers Register |
Bank impersonation reports hit their 2026 high in August, making up about a third of all impersonation reports Netsafe received that month. Tax refund scams jumped 44 per cent between April and May 2026, timed to the end of the tax year.
The signs that hold up
- Urgency. Accounts closing today, parcels returned tonight, fines doubling tomorrow. Pressure is the tool.
- A link that does not match. Hover over it on a computer, or hold the link on a phone, and read the real address before tapping.
- A request for something no legitimate organisation asks for. Passwords, full card numbers, two-factor codes.
- A sender address that is nearly right. Look past the display name to the actual address.
- Generic greetings and small language errors — though well-funded scams now write cleanly, so their absence proves nothing.
- QR codes in unexpected places. The NCSC has warned about fake codes stuck over parking meters.
The habit that defeats nearly all of it: never act from the message. Close it, open the app or type the address yourself, and check your account there.
Where to report it in New Zealand
- Scam texts: forward free to 7726, then reply with the sender’s number when prompted.
- Anything cyber: the NCSC at ncsc.govt.nz/report or 0800 114 115.
- Netsafe: 0508 638 723, or text Netsafe to 4282.
- Police: 105 for a non-emergency report, 111 if it is happening now.
- Inland Revenue impersonation: [email protected].
- Identity theft support: IDCARE on 0800 121 068.
If you have already clicked
- Contact your bank straight away if any payment or card detail was involved. Under the Code of Banking Practice that took effect on 30 November 2025, banks commit to 24/7 scam reporting and, where they have fallen short of their commitments, compensation of up to $500,000 for authorised scam payments. Report within three months of discovering it.
- Change the password on the affected account, then on anything sharing that password — our password checker shows whether it has already leaked.
- Turn on two-factor authentication, starting with email. The authenticator app guide walks through it.
- Watch for follow-up contact. Anyone who has paid once is added to lists and targeted again, often by a fake “recovery” service.
- If identity documents were shared, ask the credit bureaus — Centrix, Equifax and Experian — to suppress your credit file, and report a compromised passport to passports.govt.nz.
For the wider picture on how organisations must handle exposed personal information, see our guides to the Privacy Act 2020 and privacy breaches.
Disclaimer
General information only, not legal or financial advice. Reporting channels and the Code of Banking Practice commitments are current as at September 2026; the Code is a voluntary industry code, and outcomes depend on the circumstances of each case.
Reference sources
Frequently asked questions
How do I report a scam text in New Zealand?
Forward it to 7726, which is free on all networks, then reply with the sender’s number when the service asks. It goes to the Department of Internal Affairs.
Will IRD ever text me a link?
No. Inland Revenue does not send links or refund amounts by text, and it only texts from 5678 or 4478. Log in to myIR directly instead, and forward anything suspicious to [email protected].
Can I get my money back after a scam?
Sometimes. Report it to your bank immediately — the sooner the better, since funds can occasionally be recalled. The Code of Banking Practice provides for compensation of up to $500,000 where a bank has not met its scam-prevention commitments, subject to the circumstances.
How do I tell a real bank message from a fake one?
Do not judge the message at all. Open your banking app or type the bank’s address yourself and check for the same alert there. No bank will ever ask you to move money to a safe account.
What is smishing?
Phishing delivered by text message. In New Zealand it most often appears as parcel delivery, toll payment and tax refund messages.
Does antivirus software stop phishing?
Partly. Browsers and security suites block many known phishing sites, but new ones appear faster than they can be listed. Two-factor authentication and the habit of never acting from a message are what actually protect you.
Who do I call if I have lost money?
Your bank first, then Police on 105, and report it to the NCSC on 0800 114 115. For identity theft, IDCARE is on 0800 121 068.
