What are impersonation scams?
Impersonation scammers pretend to be a trusted entity, like a banking advisor, government official or company representative, to deceive you into providing money or personal information.
There are a wide variety of impersonation scams including phishing emails, smishing texts, impersonation calls, fake websites and web ads. Most try to use a false sense of trust and urgency in order to manipulate you.
Scammers change their tactics regularly, so keep across our latest scams to ensure you stay alert and protected.
Watch out for unsolicited contact from people claiming to be:
-
Financial or telecommunication providers
Be wary if you get a call or a text message from someone claiming to be from your bank (including us - Kiwibank), credit card provider, a telecommunication company or other organisation. They might claim they're contacting you because there have been suspicious transactions on your card or bank account, or that your computer has issues with internet access.
-
Loved ones in difficulty and in need of money
Scammers may call or message you from an unknown number, or via messaging Apps like WhatsApp, pretending to be a loved one in difficulty and in need of money. They might claim that they've lost their phone and this is their replacement number.
-
An organisation that needs personal or login details
Scammers claiming to work for reputable organisations may try to get you to disclose personal information such as your banking login details, passwords or other authentication information. They might also try to convince you to install software that allows them remote access to your computer that exposes your personal data.
Some common impersonation scams
Internet banking login
These fraudulent sites can appear to have the same look and feel as our official internet banking website.
The most secure way to log into internet banking is via our website, https://www.kiwibank.co.nz. Our site contains verified internet banking links, but you can easily find the internet banking login button at the top right-side in our navigation menu.
Downloading the mobile app
It's best to avoid downloading our mobile app outside of an official app store due to the risk of clicking on a fraudulent link. You can download our mobile app through the official App Store or Google Play.
Caller ID spoofing
Caller ID spoofing is when the caller ID on your phone displays a different number to the one being used to make the call. For example, the number shown on your screen could look like the Kiwibank 0800 number, but behind the scenes the call is actually coming from a different number. Scammers use this technique to trick you into taking the call and making you believe the call us coming from a local number or trusted organisation. Find out more about caller ID spoofing at idcare.org.
Google ad scams
We've seen an increase in customers clicking on fake Kiwibank Google sponsored ads and being directed to a page that looks like a Kiwibank webpage, but isn't. These sorts of ads have been appearing when 'Kiwibank login' or 'Kiwibank app' are searched in Google.
The fake webpages look very convincing, so make sure you check the following before clicking through:
- the ad links to our official website https://www.kiwibank.co.nz or our internet banking site https://www.ib.kiwibank.co.nz/login
- the URL doesn't contain spelling errors or mismatched characters
- the URL has "https://" at the beginning.
Remote computer access
Remote access scams are a type of impersonation scam, where the scammer pretends to work for a telecommunications, internet or technology company. The initial contact can be made by phone, text or email, and will result in the scammer requesting remote access to your computer to assist with fixing your computer or software.
Allowing remote access to your computer system means scammers are able access your personal information.
Report it
If you receive any suspicious text messages, please forward these to 7726. This will send the suspicious message to the Department of Internal Affairs, who'll also ask you for the number that the message came from.
The NZ Telecommunications forum website has information on how to notify your phone service provider, so they can look into it and block the number if necessary. You can also contact us to let us know the phone number that's been calling or texting you, and we can help you get the number blocked.
Tips to avoid impersonation scams
- Never share your password or PIN with anyone. Kiwibank - and other banks - will never ask you to reveal these.
- Call back. If you think the person might legitimately be from your bank or another company you deal with, get their name and call the company back on their official support number listed on their website.
- Confirm identities of family and friends. If you receive unusual or unexpected requests from loved ones, contact them though known phone numbers or channels. Ask them a personal question to confirm their identity.
- Maintain a healthy level of caution with unknown or private numbers.
- Never give remote access to your computer unless you know the person requesting this. They could be installing dodgy software that will enable them access to all of your personal and financial information.
- Say no and hang up. If you think you're talking to a scammer, don't be tempted to get into an argument or try and trick them, as they may then put you on a 'harass list' and you'll find yourself fielding endless nuisance calls.
- Record contact details. If you receive multiple calls or texts from the same number, record the details and try reporting them to your phone provider as a nuisance caller. You can also report them at netsafe.org.nz/report.
- Report text message spam. Scam text messages can be reported to the Department of Internal Affairs.
If you've shared personal information
- Change your passwords.
- Read the Identity Theft Checklist for a helpful guide on what could happen with your personal information if you've shared it with a scammer.
- Contact iDCare if you've been exposed to identity theft, and would like additional free help and support.
If you've given someone remote access to your computer
- Disconnect your device from the internet, then switch off your router at the wall. This will stop the scammers from having remote access to your device. If you're not sure how to do this call a friend or family member to help.
- Stay logged out. If you’re worried that something may have been loaded onto your device, don't log back on until you have had your hard drive re-formatted and your operating system re-installed. You may need a computer specialist to assist with this – remember to backup any essential files beforehand.
- Change all your passwords using a different device, so scammers can’t use your accounts. This includes passwords for banking, social networking, email and trading accounts like TradeMe or TAB. Learn how to choose a strong password.
- Run a full security scan. If the scammers had access to your device, they may have installed malware on it. Malware is a piece of software that, once installed, can damage, harm or provide unauthorised access to a computer system. IT specialists can provide assistance with detecting and removing malware, or you can start with free online virus-scanners to look for threats on your computers.
- If you have a PC try ESET online scanner or Kaspersky Virus Removal Tool. Once you've run one of those scans, run Malwarebytes Anti-Malware free edition.
- If you have a Mac, use Bitdefender Antivirus for Mac or ESET Cyber Security for Mac or AVG Antivirus for Mac.
- Contact your bank. If you use online banking, let them know you’ve been targeted. Keep an eye on your accounts and check statements for rogue purchases.
Helpful resources
What to do if you've been scammed
Anyone can fall for a scam. If you suspect that you've been scammed, get in touch with us as soon as possible.
Get in touch
Call us on 0800 113 355 (or +64 4 473 1133 from overseas) if you think you've been scammed.
Report suspicious activity
If you think you’ve been sent an email that doesn’t look like it’s from us, forward it to suspicious.email@kiwibank.co.nz.