Recently we have seen a number of emails to ourselves or clients that are Phishing. Phishing is a scam that tries to trick you into providing personal online information such as passwords, bank details and payments to legitimate sources. Once the “phishers” have your details, they can steal your money, or even use your identity for their own gain – and your loss.
Knowing how to spot a phishing expedition online will help ensure you're not caught.
Phishing is usually activated through a phony email. It often looks like it's coming from your bank or other trusted sources. In the last week we have seen examples that appear to be from a bank, the IRD and Xero. It often suggests you need to reactivate your account, your account will be closed, or you need to claim a prize. With logos and corporate-style wording, it looks legitimate.
So how can you tell if it is?
Firstly, don't trust emails from someone you don't know.
Banks do not send emails asking you to follow a link and do not ask you to verify anything online.
The IRD will not email you details of your refund - if in doubt contact us or the IRD directly.
Many phishers don’t have English as a first language, so look for poor spelling and grammar, and the quality of logos and other images.
Look at the email address it's coming from. It might have a bank name in it, but often along with something else, for example, anzguest, or bnzinfo.
If it's not addressed to you personally, ignore it.
If you do feel you've been caught because you've clicked through and provided details in good faith, notify the appropriate organisation, such as your bank, or shut down your browser, restart and change your relevant password immediately
And Xero have some good tips on how to avoid being phished on their website