Phishing Links and Scam Messages: How to Spot and Avoid Them

What Is a Phishing Link?

Scammers often pretend to be courier companies, tax authorities, banks, or government agencies, sending links through emails, text messages, social media messages, or copycat websites. Clicking these links may take you to a fake login page, a fraudulent payment page, or even trigger a malware download on your device. This technique is known as "phishing" — the scammer is fishing for you to voluntarily hand over your information.

Common phishing messages claim that a parcel is waiting and needs a delivery fee, that your account has been locked and needs verification, that a tax refund or prize is available to claim, or that a bill is overdue. The link text looks normal, but the actual destination is a fake site.

Your Everyday Safety Checklist

• Do not click links in unexpected messages. Whether the message arrives by text or email, do not click any login, payment, or verification link — even if the sender looks familiar.
• Type the official address yourself. If you want to check whether a message is genuine, close it and type the organisation's official website address directly into your browser, or call the official number you already have.
• Do not reply to spam. Even replying to unsubscribe can confirm to scammers that your number is active. Forward scam texts to 7726 (free, reports to DIA), then delete.
• Only download apps from official sources. Use the App Store or Google Play, and check what permissions an app is requesting before installing it.
• Use a different, strong password for each important account, and enable two-factor authentication (2FA). With 2FA active, even a stolen password makes it much harder for a scammer to access your account.
• Avoid public Wi-Fi for sensitive tasks. Public networks in cafes, shopping centres, and airports are not secure. Do not use them for online banking, payments, or entering personal information.
• Keep your devices and apps up to date. Updates often fix security vulnerabilities, not just add new features. Turning on automatic updates reduces your risk.
• Back up important data regularly. Save photos and documents to an external drive or cloud storage so you don't lose them if your device is compromised or damaged.

If You Have Already Clicked a Suspicious Link

1. Close the page immediately. Do not enter any personal details or passwords on the site.
2. If you have already entered a username or password, change that password immediately — and change it on any other account where you use the same password.
3. If you have provided bank card or credit card details, contact your bank right away and ask them to freeze or protect your account.
4. If you have downloaded an unknown file or app, consider restoring your device to factory settings. If unsure, contact your device manufacturer's official support.
5. You can report the incident to NZ Police on the non-emergency number 105, or contact IDCARE for specialist identity theft support: https://www.idcare.org/