Fake ANZ SMS "security alerts" pushing customers to fraudulent internet-banking login pages remain the top NZ banking spoof.

Frequent "Netcode" and "Account Verification" phishing lures targeting ASB customers via SMS and email.

Exploiting global shoppers with fake "Customs Fee Required" or "Unpaid Delivery" alerts to harvest payment details.

Highly aggressive "Unusual Order" and "Prime Membership Problem" phishing lures harvesting credentials and payment details.

Apple ID, iCloud and Apple Pay impersonations designed to create panic and harvest credentials or payment details from NZ users.

Sophisticated SMS and phone-based social engineering campaigns targeting BNZ customers with fake "account security" warnings.

Travel reservation scams using real booking details to steal card numbers and credentials from NZ travellers.

HR-themed phishing lures targeting employee portals via fake "leave request" or "policy update" notifications.

High-fidelity payment confirmation phishing campaigns are impersonating CapCut Pro to harvest credentials and payment data.

Sophisticated Google Workspace and Gmail "Security Alert" phishing designed to bypass MFA and take over corporate accounts.

Heartland Bank customers are targeted with fake loan-offer and account-verification phishing lures — attackers exploit Heartland's lending focus to manufacture urgency.

IRD impersonation scams peak during tax assessment periods, using fake "refund" promises to harvest bank details.

Kiwibank 'unusual activity' SMS phishing — pushing customers to fake internet-banking portals — is one of the most consistently reported bank-spoof campaigns in NZ.

Retail phishing campaigns impersonating Matsato Knives are targeting New Zealand organisations with fraudulent '70% OFF' exclusive offers.

Utility-themed scams impersonating Mercury with fake "overdue account" or "urgent disconnection" notices.

Social media account takeover (ATO) phishing using fake "Copyright Violation" or "Account Disabled" warnings.

Convincing Microsoft 365 "Action Required" and "Security Alert" emails remain the most common entry point for business email compromise.

Exploiting NZ shoppers with fake "Customs Fee Required" alerts to capture payment details and personal information.

High-volume delivery smishing (SMS phishing) campaigns targeting NZ Post customers with fake "unpaid duty" or "failed delivery" alerts.

Convincing "licence expiry" and "unpaid toll" smishing (SMS phishing) targeting New Zealand drivers.

Widespread "Subscription Paused" and "Payment Method Declined" phishing targeting global streaming users.

Fake ChatGPT subscription renewal notices and AI service account suspension emails harvesting credentials or payment details.

Sophisticated phishing lures impersonating PayPal "Account Limitation" alerts to harvest full identity and banking credentials.

SBS Bank customers — concentrated in Southland and regional NZ — are targeted with account-security alert phishing that exploits trust in a local mutual institution.

Spark billing and "overdue payment" scams remain a frequent vector for harvesting NZ credit card details.

Subscription-themed phishing lures targeting Spotify users with fake "payment failure" or "renewal problem" alerts.

TSB Bank customers are targeted with 'account restricted' phishing emails and fraudulent internet-banking SMS — attackers leverage TSB's strong regional reputation to lower guard.

Fake 'account suspended' emails and SMS targeting Co-operative Bank customers with lookalike login portals are a growing attack vector against NZ's only customer-owned bank.

Persistent bank impersonation campaigns using fake "Unusual Activity" SMS alerts to bypass account security.

Targeting NZ administrative and accounting staff with highly effective "Fake Xero Invoice" lures to distribute malware or harvest banking details.