Fake ANZ alert wants your login

You may receive an email with a blank subject line that appears to be an ANZ security alert. It warns that an unrecognised IP address has been detected on your account and pushes you to click a button labelled Access ANZ Portal. The message uses ANZ branding and a blue and white layout to look routine and urgent at the same time.

What makes it dangerous is that parts of the email can appear technically legitimate even though the message is not from ANZ. The sending domain is phoneryt.co.za, which does not match the brand being presented, and the message passed some basic checks that can help suspicious mail slip through filters. That means you cannot rely on branding or a clean-looking sender trail on its own. If you were to reply or follow the link, you would be dealing with an unrelated domain, not the bank you think you are contacting.

The attacker is after your banking credentials or other account details. If you click through and sign in, you could hand over access that can be utilised for account takeover, fraud, or follow-on attacks against your business.

This campaign has been seen across multiple Microsoft 365 tenants in the last day, which means you are not the only one being targeted. It keeps appearing because the messages are designed to look credible enough to evade suspicion and reach different organisations.