Phishing in New Zealand: how attacks actually reach your staff

Phishing in New Zealand: how attacks actually reach your staff

Phishing succeeds when a message fits the work someone is already doing. An accounts administrator expects invoices. A manager expects shared documents. A new employee expects payroll instructions. Attackers exploit those expectations to steal passwords, obtain access to business systems or persuade someone to move money.

For New Zealand businesses, recognisable disguises include courier delivery notices, IRD messages, bank alerts and Microsoft 365 sign-in requests. Workplace lures include overdue supplier invoices, tender documents and requests to update employee bank details. Logos and polished language are easy to copy; neither proves a message is genuine.

Email is often only the starting point. A message may lead to a fake login page, ask the recipient to scan a QR code with their phone, or direct them to call a supposed support number. Attackers also use legitimate file-sharing services to deliver links. Protecting staff therefore means controlling what happens after a message arrives, not just trying to block every suspicious email.

Why a familiar sender can still be dangerous

Some phishing uses a lookalike domain: a supplier’s name with one letter changed or an extra word added. Other messages simply change the display name, so an email appears to come from your chief executive even though the underlying address is unrelated. Mobile email apps can make that difference less obvious.

More convincing attacks come from a genuinely compromised mailbox. An attacker can read an existing conversation, learn who approves payments and reply inside the same thread. The signature, project details and previous correspondence may all be authentic. An unexpected request still needs checking, even when the sender’s address is correct.

Credential theft also goes beyond basic fake login pages. Some attacks relay a real sign-in through an attacker-controlled site and capture the resulting session. That means ordinary MFA is valuable but is not a complete defence. Staff should open their usual bookmark or business app rather than sign in through an unexpected message.

• Treat unexpected login prompts, bank-detail changes and requests to bypass normal approval as verification triggers.
• Check the full sender address and link destination where possible, but do not make visual inspection your only control.
• If a message contains a QR code, open the known service directly instead of scanning it to sign in.

Stop invoice fraud with a payment rule, not a judgement call

Invoice fraud often involves a small change to a legitimate transaction. A supplier supposedly has a new bank account, an executive needs an urgent transfer, or a contractor sends a replacement invoice. The goal is to make the payment look routine enough that nobody independently checks it.

Set a written rule: new supplier bank accounts and changes to existing payment details must be verified through a separate, trusted channel. Call a number already held in your supplier records or an established contact you know. Do not use the number supplied in the change request, and do not treat a reply to the same email thread as independent confirmation.

Record who verified the change, when they did it and which trusted contact they used. Separate supplier-record changes from payment approval wherever staffing allows. In a small business, the owner can provide that second check. The process must also apply when someone is away or a payment is described as urgent.

• Require a second approver for bank-detail changes and payments above your documented threshold.
• Apply the same verification process to employee payroll bank-account changes.
• Use bank account-name checks where available, but do not let them replace independent verification.
• Tell staff explicitly that delaying a payment for a required check is acceptable, including requests apparently from senior management.

Configure email and identity controls to limit the damage

Ask your IT provider to review your actual configuration, not just list the security products you own. Useful email protections include impersonation detection, attachment analysis and checking links when they are clicked. Confirm that these protections cover shared mailboxes and that broad allow-lists are not bypassing them.

Publish SPF and DKIM records and introduce DMARC enforcement after identifying legitimate sending services, including payroll and marketing platforms. These controls help prevent attackers impersonating your domain. They do not stop lookalike domains or malicious messages sent from a compromised supplier account.

Require MFA for email, remote access and administrative systems. Prioritise phishing-resistant methods such as FIDO2 security keys or appropriately configured passkeys, particularly for finance staff and administrators. Disable legacy authentication methods that bypass modern protections. Protect account recovery too: a weak help-desk reset process can undermine strong sign-in controls.

• Block automatic forwarding to external addresses unless there is a documented business need.
• Alert on suspicious inbox rules, unexpected forwarding and unusual sign-in activity, with someone assigned to investigate.
• Restrict user consent to third-party applications so a deceptive permissions request cannot quietly grant mailbox access.
• Use separate administrator accounts, least-privilege access and managed, updated devices to reduce the consequences of one compromised account.
• Ask who handles security alerts overnight and on public holidays, what action they can take, and how they contact your business.

Train staff for the decisions they actually face

Training should reflect each team’s work. Give accounts staff a bank-detail change to assess, managers an unexpected document-sharing request, and reception a courier message. Teach the next safe action rather than asking people to memorise every possible warning sign. Perfect spelling and a familiar logo are not reliable indicators.

Provide a report-phishing button or another simple reporting route. Staff should know whether reports reach your internal team, help desk or security operations centre, and what to do if they receive no response. Encourage reporting even after someone has clicked, entered a password or approved an MFA prompt.

Use short refreshers and carefully scoped simulations to find gaps in both behaviour and process. Avoid public rankings or punishment: embarrassment can delay the report that prevents a loss. Track whether people report quickly and whether the response team acts, rather than relying only on click rates.

Prepare the response before a suspicious message arrives

Write a one-page response plan with named contacts, an after-hours route and clear authority to contain an account. If someone entered credentials or approved an unexpected sign-in, contact IT immediately. Responders should revoke active sessions, reset compromised credentials, inspect MFA methods and application permissions, and check forwarding rules and mailbox activity. A password reset alone may not remove every access path.

If money has been sent, contact your bank’s fraud team immediately and request recovery action. Preserve the message and transaction details, and contact the supplier using trusted records. Report the incident to the NCSC through its official reporting channel and consider Police reporting. Assess whether exposed personal information triggers Privacy Act notification obligations.

Start with three checks this week: test your staff reporting route, review MFA coverage and confirm that finance independently verifies every bank-detail change. Then ask your IT provider to identify configuration gaps, assign owners and agree deadlines. Protection improves when controls are demonstrably working, not merely included in a service description.