Phishing scams

Last Updated30/07/2024

What is a phishing scam?

Phishing, also known as email scams or email fraud, is a deceptive tactic used by cybercriminals to trick individuals into divulging sensitive personal information like bank account numbers and passwords. It often involves scammers contacting a large number of individuals in an attempt to have them disclose confidential information, such as passwords, bank account numbers, and other financial information.

Scammers use this information to impersonate and/or defraud people. Phishing scams can seem like they’re specifically targeted at you, but in reality the scam is being sent to hundreds, if not thousands of people at the same time – only some of these people need to fall for it to make it profitable. Understanding more about phishing scams can help you recognise these scams and safeguard you against potential identity theft and financial exploitation.

If you think you’ve been the target of a phishing scam you can contact Netsafe for advice and guidance. Our helpline is free, confidential and available 7 days a week.

Report online

Email [email protected]

Text 'Netsafe' to 4282

Call 0508 638 723 8am-8pm weekdays, 9am-5pm weekends

New Zealanders overseas can call +64 9 666 0840

What to do if you think you've been targeted

If you think you've received a phishing email it's important that you:

- DO NOT open it

- DO NOT reply to it

Steps to take if you think you've received a phishing email:

Mark the email as junk mail. When an email is marked as junk mail, your email filter will learn to redirect emails from that scammers email address away from your inbox.
Scan for malware. If you’ve clicked through any links or attachments that were included with a suspicious email, our advice is to check for malware (malware is malicious software such as viruses) on the device you were using at the time. You can use a free online scanner to look for threats on your computers (see suggestions at end of page).
Contact your bank immediately. If you provided any sensitive personal information or security related information such as your mother’s maiden name, and/or former residential address or bank account details, you should contact your bank immediately. It’s important that you explain the situation to them in full and give the bank the opportunity to decide on the security process to follow.
Use this  Identity Theft Checklist(https://www.dia.govt.nz/diawebsite.nsf/Files/EOI/%24file/identity_theft_checklist_pdf-a.pdf) as a helpful guide on what could happen with the information you provided. If you believe you were exposed to identity theft, we recommend you contact iDCare(http://www.idcare.org/) as they provide free help and support for New Zealanders.
Forward the scam email to the legitimate organisation it’s impersonating so they are aware.

How to spot a phishing scam

Some phishing emails look obvious, others are not. Email scams are becoming increasing difficult to spot as scammers become more sophisticated and develop their techniques.

Basic rules

Below are some basic rules to follow to help keep yourself safe online. If you’re still unsure if an email is legitimate or not, you can contact us for guidance and advice.

Be cautious of emails that:

Have a deal or offer that is too good to be true.
Contain spelling and grammatical errors.
Contain a hyperlink to an odd-looking address, or an address not associated with the business it is meant to represent.
Urge you to act immediately or call you to action something with urgency.
Come from an email address that is not associated with the business it is meant to be representing. For example, if someone from Spark emails you, the email address will not appear as coming from Gmail. This would likely be a Spark Phishing email.
Are from senders you don’t recognise, or where their name does not appear correctly.
Come from companies you have had no interaction with.
Feature logos that don’t look right.

How does phishing work?

Collection of contact information:

Scammers often source contact details like names, email addresses, and phone numbers from various online platforms. This information can come from data breaches or be publicly accessible, such as through online business registrations or social media profiles.

Sending mass emails:

Scammers gather information about a large group of people and send out a bulk email to many in the hope that a few will respond. These emails are crafted to mimic those from legitimate entities like banks, charities, or known businesses by using similar branding, logos, and language.

Enticing offers or scare tactics:

Enticing Offers: The emails may offer something attractive, such as significantly discounted products or services, or even claim that the recipient has won a prize or has an inheritance to collect.
Scare Tactics: Alternatively, scammers may use fear-based tactics, such as sending emails that appear to be from service providers (e.g., telecommunications companies or subscription services) warning about an urgent issue like service cancellation, overdue charges, or legal consequences.

Requests for sensitive information:

These emails often include requests for personal information under the guise of needing confirmation or verification. This request may come in the form of:

Attached documents.
Links to fake websites.
Contact details or instructions within the email.

Installation of malware:

Sometimes, phishing scams may involve the installation of malware(/online-safety-at-home/anti-virus-software) on the recipient's device if they click on a link or open an attachment. This malware can then be used to steal personal information or cause other harm.

Collection of details:

Phishing emails will typically ask for highly sensitive information like bank account details, credit or debit card numbers, account credentials, or even drivers’ licence or passport details.

'Spoofed' emails:

Scammers often create 'spoofed' emails that are designed to look like they are from the legitimate business or organisation being impersonated. This includes manipulating the sender information to appear authentic.

If you suspect there may be malware on your device, it is advisable to consult with a professional IT specialist who can identify and remove the malware for you.

Types of phishing scams

Email scams and email fraud

The scammers make contact at random, with claims to need your details to authorize a fake transaction or dispute a fake charge or invoice. They lead people to realistic websites for you to input your personal information, or direct people to websites which download viruses on to your computer.

Spear Phishing

This is the same as regular phishing but is very targeted. Scammers will focus on a specific organisation or individual and customise the phishing email. These attacks are more likely to deceive due to the time spent on researching and personalising the message that may appear as coming from legitimate senders.

Whaling

A whaling attack is similar to spear phishing, except the scammer will target high-level management. Whaling attacks will attempt to scam more valuable targets or more classified information.

Smishing (SMS-phishing)

This is identical to phishing but is sent on mass scale via text message (SMS). These may impersonate a:

Parcel delivery from a courier, similar to the DHL fraud email.
Bank payment authorisation, like a BNZ phishing or Westpac Fraud email.
Payment to a government organisation, like a toll payment or an overdue car registration

Vishing

Phone call or voice message phishing scams typically involve direct communication with a scammer through phone calls. Sometimes, these scams manifest as automated messages, which play when the target answers the call or when it goes to voicemail. These messages often mimic legitimate business directories, instructing the individual to press an extension number to dispute a supposed charge or make changes to an account.

Solutions and support

How can I protect myself?

Be cautious of emails asking you to update or verify your details online.
Be wary of emails saying you’ve won prizes from competitions that you don’t remember entering.
Be cautious of emails that try to get you to act quickly by threatening you with legal action or loss of an account.
Ignore any emails asking you to provide personal information like passwords, or banking information.
Remember legitimate organisations like banks will never ask you to send them your password.
Only open email attachments when you’re expecting them, even if you know who the sender is.
If you’re unsure if an email is from a legitimate organisation, you can contact them to ask. If you do contact them, make sure you go through their official contact channels found on their website – don’t use the phone numbers, websites or email addresses included in the email.
You can try an internet search using the names or exact wording of the email to check for any references to a scam – many scams can be identified this way.
If you’re still unsure if an email is legitimate, you can contact us for advice.

Report phishing scams

If you think you’ve been targeted by a phishing scam, inform your friends and family to help them avoid falling victim.

You can contact Netsafe seven days a week for free, confidential and non-judgmental advice about an online issue impacting you or someone you know.

Whilst we cannot investigate or track scammers, we can provide advice on steps you can take to stay safe and what to do if you think you’ve been scammed.

Report online

Email [email protected]

Text 'Netsafe' to 4282

Call 0508 638 723 8am-8pm weekdays, 9am-5pm weekends

New Zealanders overseas can call +64 9 666 0840