The release of income tax assessments by Inland Revenue in New Zealand has triggered heightened warnings regarding cyber threats targeting taxpayers during this period.
Norton experts have highlighted an anticipated surge in tax-related scams, as cybercriminals are expected to exploit the annual tax cycle. During this time, many New Zealanders are eligible for tax refunds or contacted about tax owed, creating opportunities for fraudulent activity.
Mark Gorrie, Managing Director Norton APAC, commented on the increased risks faced by New Zealanders in the current climate, particularly with the emergence of sophisticated cyber tactics.
“New Zealand is one of the most heavily impacted countries by a new wave of AI-driven, hyper-personalised cyber threats. That makes tax time an especially risky period,” says Mark Gorrie, Managing Director Norton APAC. “Our latest Q1 2025 Threat Report points out that breached data and AI tools are giving cybercriminals just enough personal information and design sophistication to easily manipulate people.”
With cybercriminals leveraging breached data and generative AI tools, scams are taking increasingly convincing forms. The tactics commonly seen include phishing emails, impersonations of Inland Revenue staff via phone, fake refund offers, fraudulent payment demands, and identity theft using individual Inland Revenue numbers.
Specific scam types
Phishing emails are frequently used to impersonate Inland Revenue, often suggesting there are issues with tax refunds or tax returns. These messages can contain links that, if clicked, may compromise personal information or install malware. Another prevalent method involves fake Inland Revenue phone calls, with scammers purporting to demand immediate payment for tax debts that do not exist.
Identity theft remains a significant concern, with some scammers illicitly lodging fraudulent tax returns in the names of legitimate taxpayers. Social media platforms are also being used to approach individuals with offers of fake tax assistance or by posing as official representatives.
Emails sent with counterfeit tax documents may contain malware payloads, while bogus refund offers aim to harvest sensitive information such as bank details. Additionally, scam charities seeking “deductible” donations and tax payment scams requesting payment via prepaid gift cards or other unusual repayment methods have been observed.
Protective guidance
Norton’s guidance emphasises vigilance, especially concerning communication purportedly from Inland Revenue. Kiwis are advised to note that Inland Revenue does not include refund amounts or login links in emails or text messages. Any domains that differ from the official ird.govt.nz should be regarded with caution, with examples such as ird.com.nz or ird.qovt.nz identified as suspect.
Key phrases often used by scammers, such as “fiscal activity”, “excess payment” or “Department of Taxes”, have been flagged as warning signs. Individuals are reminded never to provide personal information over the phone unless the caller’s identity has been independently verified, recommending that people hang up and dial Inland Revenue directly using the official number.
To reduce risk, strong, unique passwords should be used, and two-factor authentication enabled where possible. Securing personal documents and limiting the sharing of personal information on social media are also recommended steps, with the recognition that scammers may use publicly visible information to create convincing lures or guess security questions.
Identity protection services are suggested as an additional safeguard, capable of monitoring personal and financial data, alerting users to unusual activity, and providing assistance in the event of identity compromise.
Ongoing risk
As Inland Revenue continues issuing tax assessments, security experts caution that the cyber threat landscape remains fluid, with tactics constantly evolving in sophistication. The annual tax cycle, historically a hotbed for scams, could see greater targeting as personal data is increasingly available to malicious actors.
