Phishing in New Zealand: How the Attacks Work and How to Spot Them

Why phishing still works

Phishing works because it targets urgency and trust, not technical weakness. The messages impersonate organisations New Zealanders actually deal with - Inland Revenue, NZ Post, the major banks, courier companies - and demand action before you think: log in now, pay this invoice, verify your details, your parcel is waiting.

Attackers are also getting better at the local details: correct spelling, plausible sender names, real-looking logos, and links that look right until the last character.

The patterns to check in ten seconds

Before clicking, look for: a sender address that isn't quite right (ird.govt.nz vs ird-govt-nz.com), pressure language and short deadlines, requests for credentials or payment that you weren't expecting, and links you didn't ask for. When in doubt, open the organisation's website yourself or call them on their published number - never the number in the message.

The control that saves you: MFA

Even a staff member who clicks and enters their password doesn't have to be a breach - if multi-factor authentication is on. MFA stops most account-takeover attacks cold, which is why it's the single highest-value control available to a New Zealand business of any size.

Training beats tech alone

Filters catch the obvious attacks; the dangerous ones need a human to say 'wait a minute'. Short, regular security awareness training - including how to report suspicious email - turns your staff from the biggest risk into your best detection system.