Phishing is a type of scam where the scammer poses as a legitimate entity, often through deceptive emails, text messages (SMShing) or websites, in order to trick you into revealing sensitive information like passwords, credit card details, or personal identification.

These communications are designed to appear trustworthy and usually have a sense of urgency in the messaging. It’s important to be vigilant and verify the authenticity of any requests for sensitive information online to protect against phishing attacks.

• Check the email address or number this has come from and if it looks “phishy” contact the company on their trusted email, phone number or webpage. Always delete these types of emails and install antivirus to help detect these malicious emails.
• Never click any links in text messages. Contact the organisation directly on trusted contact details. Always delete these types of text messages.
• If you receive a suspicious text, you can report it to the Department of Internal Affairs free of charge by forwarding it to 7726. Once reported, you’ll receive a text response asking you to complete a report. This will help stop others from failing for the same scam.

These types of scams are still circulating with further merchants and websites being identified by the Financial Markets Authority. Extreme caution is recommended when engaging with social media advertising using the images of celebrities to promote investment opportunities. If you come across these ads, do not click on the link and do not enter your personal information.

How this scam works

• The scammer creates an advertisement on a social media platform featuring a deepfake video of an interview with a celebrity or a fake news article, appearing to be from a reputable New Zealand media platform. The ad usually includes the image of a New Zealand celebrity with an attention-grabbing headline. The ad does not at first glance appear to be about investing.
• Clicking on this ad leads to a fake news article on an imposter website designed to look like a reputable New Zealand news platform. This article describes an interview with a celebrity where they discuss making big profits using a certain investment platform.
• The article contains a link to the website of an investment platform – often trading cryptocurrencies or foreign exchange – where people are asked to register for an account and provide contact details.
• After providing this information, a call is received from someone claiming to be a broker or a financial adviser instructing the person to make a payment of $250 USD or €250 euros, for example.
• They may instruct the person to download remote access software such as “AnyDesk” so the fake adviser can “help” with the investments.
• The scammer will transfer “profits” to the victim’s bank account giving a false impression of legitimacy.
• Instructions are then made to make higher investments, and dashboards are provided tracking these apparent investments.
• When the victim asks to withdraw funds, they are told they must first pay a high fee to release the money. But even if these fees are paid, no money is returned.

See above sections for warning signs, tips on how to avoid being scammed and what to do if you have been scammed.

Mobile Wallet Scam

How this scam works

The scammer registers your card details in their mobile wallet on their device. Mobile wallets include Google Pay or Apple Pay — services which allow you to make purchases without using your physical card.

The scammer might get your card details and online banking login details from phishing texts or emails, social media messages, or phone calls. They may also trick you into providing two-factor authentication codes to activate your card on that new wallet and device.

While mobile wallets are safe, if scammers have access to your card details and two-factor authentication codes, they can add your card to their own device and make purchases without your permission.

Remember to be cautious. Unity staff will never ask you for any two-factor authentication codes, financial or banking details. See above sections for warning signs, tips on how to avoid being scammed and what to do if you have been scammed.

Scammers are targeting parents by impersonating whānau and claiming they've lost their phone to explain why they’re using a new number. These messages may come from WhatsApp, new phone numbers, or new (or fake) social media accounts. 

How this scam works

Scammers may impersonate your child claiming they've lost their phone. They may say:

• It's an emergency and they urgently need money, or
• They need help paying their bills, or
• They need money for something they want to buy.

How to stay safe

• Check if it’s really your child. Contact them directly using their normal number or try video calling.
• Use a family code word. Pick a word that everyone in your family knows so you can check if they’re the ones asking for help.
• Don’t give in to urgent requests for money, even if it sounds like an emergency. It’s okay to take your time and double-check the legitimacy of the contact.
• Block the scammer’s number or account.

What is a Facebook Marketplace scam?

Facebook is not only a platform for keeping in touch with family and friends, but also a popular hub for local ‘buy and sell’ groups and business pages. While many of these pages and people are genuine, some unfortunately involve scammers.

We have recently seen a rise in reports concerning Facebook Marketplace scams, which typically involve either the seller or the buyer of an item.

Types of Facebook Marketplace scams

Seller scams

This Facebook Marketplace scam involves the buyer paying for an item such as a device or furniture but either receiving nothing or receiving an item that is significantly different from what was advertised.

Often, the scammer will block the buyer, making it impossible for the buyer to contact them again. In some cases, messages from the buyer to the seller are ignored.

Buyer scams

In this variant, the scammer poses as a buyer interested in an item and insists on arranging delivery themselves. Scammers will send the seller a link to a fake website that mimics a legitimate delivery company, asking the seller to pay a small ‘insurance fee’ to initiate the delivery process. The fake website is designed to obtain banking details from the seller.

Identifying genuine vs. scam buyers and sellers

Business pages

Fake business pages can appear legitimate at first glance. Engage with pages that have detailed profiles and active selling histories. Check customer reviews for any negative feedback or red flags. Use Google to search for further information on the business or to see if it appears in reports of scams.

Seller profiles

When interacting with a seller, look at how active they have been with previous sales. Conduct an online search of their name to see if it appears in reports of scams.

Delivery companies

If a buyer wants to use a specific delivery company, research the company online to check for negative reviews or discrepancies in contact details.

Common Scammer Tactics

• Overpayment Scams: A scammer claims to have paid more than the asking price and asks the seller to send the overpaid amount back. 
• Fake Payment Confirmations: Scammers send fake emails or screenshots of payment confirmation, hoping the seller will send the item before verifying the actual funds. 
• Phishing and Information Theft: Scammers ask for personal details, bank login information, or phone verification codes (like a Google Voice code) to gain access to accounts. 
• Bait and Switch: A seller advertises a desirable item at a very low price but, once the buyer shows interest, claims it's unavailable and offers an inferior or more expensive alternative. 
• Advance Payment Scams: A seller requests an upfront payment for a high-demand item or a rental but then disappears with the money. 
• Fake Shipping/Insurance Fees: A scammer sends a link to a fake shipping/courier company, asking the seller or buyer to pay a small fee to cover delivery costs. 

Tips for transaction safety

• Verify identities: Conduct thorough profile reviews and online checks to authenticate buyer or seller identities.
• Secure payment methods and verify payments: Use secure payment options provided by platforms, such as PayPal. Always check your official bank or platform account to confirm funds have been received before sending or giving away and item. Steer clear of payment methods like gift cards
• Meet in safe, public places: If possible, arrange to meet in person and make payments after viewing the product.
• Trust your instincts: If something feels wrong, do not proceed with the transaction or if a deal seems too good to be true – it probably is
• Avoid sharing financial information: Never enter your banking information on websites sent by buyers or sellers and do not share phone or email verification codes as these can be used to take control of your accounts.
• Stay on the platform: Keep all communication within the official messaging app to protect your personal information.
• Be wary of urgency: Scammers often pressure you to act quickly, but you have the right to take your time

Card fraud can happen in many ways, and scammers are becoming increasingly sophisticated. Knowing the risks and taking a few simple precautions can help keep your money safe.

Common types of card fraud

• Lost or stolen cards: Someone finds your card and uses it without your permission.
• Card skimming: Thieves use devices to steal your card information from ATMs.
• Data breaches: Your card details are stolen from online stores or company databases.
• Phishing scams: You’re tricked into sharing your card information through fake websites, emails, or messages.

A new scam to watch out for – Bank Card Collection Scam

Scammers are currently impersonating bank staff, often over the phone, and convincing card owners to hand over their bank card numbers and PINs. Scammers typically:

• Call pretending to be from your bank and claim your card has been compromised.
• Offer a fake ‘secure collection service’ and ask you to leave your card and PIN in your mailbox for pickup. Unity will never collect your card. We’ll never ask you to leave your card or PIN in your letterbox or send someone to collect it.
• In some cases, they also ask for your PIN over the phone and try to gain remote access to your devices to get into your online banking.

Once they have your card and PIN, scammers make ATM withdrawals and purchases, including buying gift cards. This scam is happening across New Zealand and can be convincing because the scammer seems to be helping you.

Tips to Protect Your Card

• Protect your card: Keep it safe and never share your PIN or CVV.
• Monitor your account: Regularly check for any unusual transactions.
• Use strong passwords: Create unique, secure passwords for online banking.
• Be alert for phishing: Don’t click suspicious links or open unexpected attachments.

Manage Your Card Online

You can now take control of your Debit Mastercard through Internet or Mobile Banking at any time:

• Change your PIN to keep it secure.
• Temporarily block your card if you’ve misplaced it.
• Cancel your card if it’s lost or stolen.
• Disable online shopping and contactless payments for extra protection.

Criminals may trick or use someone called a ‘money mule’ to help them transfer or hide stolen money.

The mule might be asked to transfer stolen money to another bank or crypto currency account, withdraw the money or buy gift or gaming cards to give to someone else.

Sometimes a money mule might even sell access to use their bank account or cards.

If you are a money mule, it is very serious. You could be arrested and prosecuted for money laundering.

While money mules may be tricked into being involved in moving stolen money for criminals, you may be breaking the law and may impact how easily you can get a bank account.

Common examples of money mule scams:

• Someone offers you a job where you’re asked to transfer money deposited to your account to others, keeping a ‘commission’ for your involvement.
• You’re offered money to sell your account to someone, including giving that person your online banking login credentials, personal information, PINs or card details
• You’re offered money to receive funds into your account and give your debit card to someone who withdrawals those funds.
• You’re asked to buy gift or gaming cards and give the card details to someone else.
• You’re asked to set up crypto currency accounts using money deposited into your bank account by someone.
• You may be asked by someone you’re in a relationship with online to transfer money you receive into your account to them or to someone else for them.
• You may even be threatened to send someone money that is deposited into your account.

Remember – be sceptical, if it's too good to be true it usually is. See above sections for warning signs, tips on how to avoid being scammed and what to do if you have been scammed.

Scammers employ various methods in an attempt to steal their victim’s money, personal information, or trick them into facilitating the proceeds of crime. These methods can involve the use of letters, emails, phone calls, social media and different websites. They can create fake profiles on dating websites, apps or social media platforms and attempt to create a relationship with you to retrieve personal information or money.

Staying vigilant and educating yourself on the methods a scammer may use to gain access to your information is one way you can protect yourself.

You may be caught up in a romance scam if the other person:

• When communicating, avoids speaking with their face showing on video calls or,
• Makes excuses to not video call or meet you in person, so you’ve never seen them on video or in real life.
• Spends months establishing a friendship or relationship, then starts asking to borrow increasing sums of money or persuades you to invest in confusing schemes.
• Says they have a problem or family emergency that they need your help with – they make it seem urgent and need you to decide quickly or instantly.
• Is quick to profess their love or admiration, or wants to move the relationship to the next level quickly, e.g. proposing within a short amount of time.
• Pressures you into doing what they ask of you – they may say you should do it to prove you care.
• Says they work in a hard to reach or isolated place like an oil rig, or in the military, or even just overseas.
• Asks you to leave a dating site and communicate directly using email or a messaging service like WhatsApp.
• Attempts to isolate you from friends and family.

You may only notice one or two of these signs, but if you feel uneasy or unsure about any requests from an online friend or partner, or your relationship with them, talk to a trusted family member or friend.

Romance scam leading victims to fake banks

Scammers are posing as romantic partners, then tricking victims into opening accounts with fake banks. This is a romance scam, which attempts to harvest victims’ personal information and then take their funds.

How the scam works:

• After establishing a relationship with the victim, the scammer asks for help with a financial problem. For example, they may need the victim’s help receiving their wages from their employer. They instruct the victim to open a new bank account and direct them to a particular bank’s website. This bank is a fake, and the website is controlled by the scammers.
• During the account-opening process, the ‘bank’ requests extensive personal information from the victim, including photos of the victim’s passport and other identification documents. The scammers can use this information to impersonate the victim, or they can sell this information to other scammers.
• Once the victim has opened an account, the scammers can start requesting payments. The scammers have control over the bank’s website, so they can manipulate the victim’s account and make it appear as though they have received a large payment. The scammers will often say that fees or taxes need to be paid by the victim before they can access this money. However, even if the victim makes these payments, no money will be released.

A list of fake banks linked to this scam can be found on the Financial Markets Authority website here.

How to avoid these types of scams:

• Beware of any unsolicited friend requests from strangers. Requests can come via email, social media, dating sites or any other website or apps.
• Never send money or gifts, financial or personal information to someone you don’t know or haven’t met in person.
• If the person always has excuses for not meeting you in person or video call, cut all contact.
• Be cautious about who you communicate with online and what you share online. It’s easy for scammers to pose as someone else online. If you haven’t met the person before, be aware that they may not be who they claim to be.
• Never invest in something that you don’t understand or haven’t done your own research on.
• Google their name – others may have reported them online.
• Try not to overshare personal information such as family history and never share passwords or bank details.

For more information on what to look out for, how to avoid being scammed and what to do if you have been scammed see above sections.

Scammers often impersonate organisations and brands you are familiar with and rely on in order to steal your personal information and money. These organisations are most commonly your bank, phone and internet provider, and the Police. Scammers will go to extreme lengths to gain your trust, including using the names of actual staff members to appear legitimate.

Currently, we are aware of telecommunication scams where scammers are claiming to be from ‘Spark’ or ‘Chorus’. Customers are advised their internet is running slow and need help to upgrade it. Scammers instruct them to download remote access software (eg ‘AnyDesk’) on their computers and that they should check their internet banking has not been affected. They are asked to log in to their bank account, and in the background, the remote access allows the scammer to transfer money out of the customer’s account.

The customer may also be asked to pay for the fake internet upgrade service for a fee and to provide their card details, that are then used by the scammer for fraudulent purposes.

Be suspicious of any unexpected phone calls and see above sections for warning signs, tips on how to avoid being scammed and what to do if you have been scammed.

There are recovery scams going on at the moment which use phishing tactics to access bank accounts. Recovery scams target people who have already lost money to previous investment scams.

Scammers falsely claim that lost funds have been recovered, but to access these funds victims have to provide personal information.

How the scam works:

• Scammers contact victims by calls or emails claiming to have recovered funds lost in a previous scam.
• Scammers direct victims to a website in which victims need to “sign up” to get access to the recovered funds.
• The website asks for personal information and prompts the victim to enter their bank account username and password. To seem credible the page may display NZ banking logos.
• Once the scammers have this information, they access the victim’s bank account and transfer funds out.

Tips for avoiding recovery scams:

• Treat any organisation that claims they can help recover your scam losses with suspicion. Stay vigilant and consider whether it might be trying to target you with another scam.
• Resist urgency – scammers push you to act fast, genuine organisations won’t. Take your time and think before you act.
• Verify who you’re dealing with – search the company or person online. Look for reviews, warnings, and their official contact details. Use those details to confirm they’re genuine and not an imposter.
• If you’re still unsure about a recovery agency, share the details with a trusted friend or relative, or seek professional advice. A view from someone independent can help highlight red flags.
• If you’re asked to make payments or share financial information, call your bank immediately for advice.
• Be careful about posting your scam story online – it can make you more visible to recovery scammers. These scammers will search for social media comments or posts form people who have lost money, and sometimes use fake or hijacked social media profiles to make contact, saying they too have been a victim but were able to get their money back. They will recommend a company that can help – directing the victim to the recovery scammers.

See the Financial Market Authority website for a list of confirmed organisations and websites associated with this type of scam.

Scammers will target children and teenagers with scams that are designed to exploit their trust and vulnerability. It is important that you know what these look like so that you can stay safe and know how to get help if you need it.

Common types of Scams:

• Friendship and Relationship Scams: Scammers and those who prey on children use fake profiles online, particularly over Instagram or Snapchat, to gain trust and establish a relationship. This can begin as a friendship and progresses to encouraging the sharing of private photos, videos or personal information with the purpose of extorting money or pursuing other criminal actions.

• Gaming Scams: Fraudsters can target gamers by offering free items, upgrades or cheats. These often come with links that steal personal information, banking details or money. Be cautious of people that approach you in a game and want to share account details or send you unknown links.

• Social Media Scams, Fake Investment or Job Scams: Fake accounts are used to reach out pretending to be someone you already know, a celebrity or an influencer offering giveaways, designer gear, money or jobs. These phishing attempts aim to steal your personal details, have you opening accounts on behalf of others, trick you into receiving stolen money into your account and have you send on stolen money. On the surface the opportunity to make quick and easy money might be appealing. In reality, criminals want to use you and your legitimate bank account to store or hide stolen funds.

• Online (Cyber) bullying: There is a marked difference between banter, joking around, and cyber bullying. Banter is a friendly and light-hearted exchange between people. Bullying is done with intent to shame, upset, belittle, offend, or make someone uncomfortable. If you are having rumours spread about you, being mocked and shamed online, receiving repeated unwanted messages, being hacked or impersonated by someone else, there is help available:

Advice for Children and Teenagers

• Don’t respond to the bullying.
• If you have concerns for your safety or someone close to you, call the Police on 111.
• Talk to a trusted adult - a parent, teacher or someone you are close to.
• Save screenshots, recordings, usernames, URL’s and any other evidence of bullying.
• Block harmful content, unfriend and if on social media report it to the platform.
• Call your bank if your card or online banking information has been shared.
• For free and confidential advice:

Netsafe

Youthline – 0800 37 66 33, text 234, or chat online

Advice for Parents and Adults

• Consider installing software on devices to restrict content to certain sites or monitor activity.
• Know who your children are connecting with online.
• Know which social networking sites your child is on and what information they are posting.
• Check that your children understand the dangers of posting personal information on social networking sites.
• If you or your child becomes suspicious about a person online, stop contact immediately.
• More information is available on the NZ Police website.

Back to School scams

When children are heading back to school, it’s a busy time for both the students and their parents or caregivers. It is easy for parents to get overwhelmed with registrations and new schools, school fees, uniforms, shopping lists, new computers, platforms and apps.

Take extra care during these times, as scammers are targeting parents with a number of phishing campaigns. These could be offers from fake online stores with major discounts on school supplies, fake emails offering financial aid, tutoring, or tech support, and even fake phones calls to collect school fees. Don’t be fooled by everything you see online or get phone calls about.

If you receive a call or email requesting payments like these either hang up the phone or do not click on any links within the email. If you are unsure, instead contact the sender on their publicly listed phone number or email address to confirm the message is genuine. If the email is fake, you can mark the email as spam and delete it. If you have made an online order recently, you can contact the business directly to confirm if there is a problem with it.

It can be difficult to stay vigilant during these busy times, so if the deal seems too good to be true, it probably is!

Be aware of phishing text messages and emails made to look like they are coming from NZ Post. They are attempting to trick you into passing your personal or banking information on to scammers so they can steal your identity and exploit you for financial gain. The messages will say that you have an undelivered parcel and request that you click on a link to provide further information to enable delivery, arrange pick up or complete payment. The link is designed to take you to a fake website, where scammers can steal your personal information.

If you get one of these messages and you’re unsure if it’s a scam, take notice of the phone number or the email address it has originated from, and any suspicious links.

NZ Post will never:

• Ask for any of your personal information by email or text (including usernames, financial information including password, credit/debit card details or account information).
• Send you an email from a domain other than nzpost.co.nz.
• Send you a text message from an email address.
• Send you a text message from a phone number outside of New Zealand.
• Use a messaging app like WhatsApp to communicate with customers.

If you receive a text or email of this kind, do not click on any links and delete the message immediately. If in doubt, you can contact the company directly through their publicly listed information.

The next time you get an unexpected text or email, take time to check it thoroughly before you respond.

Are you due a tax refund? Whether you are or not, beware of scammers sending fake emails, texts, social media messages and making cold calls, that say you have a tax refund owing.

Clicking on the fake link in one of these messages could lead to your banking details, username, passwords and other private information being compromised.

The messaging can come in many forms, so be sure to stay vigilant. Some examples are:

• “your refund is now available to claim visit [FAKE LINK]”
• “your tax refund is place on hold pending account verification, to verify [FAKE LINK]”
• “the last balance on your account has been paid twice due to a systems error please complete to get a refund [FAKE LINK]”
• “your tax return was not completed please verify your details [FAKE LINK]”
• “we couldn’t find an account to deposit your tax refund. Enter your details to process your payment at [FAKE LINK]”

Always be wary before clicking on any links and do your due diligence:

• Go to the IRD’s publicly listed website for up to date information and things to look out for
• Don’t rush into repaying. Take a ‘sec to check’
• Is the IRD email address the correct one on the email?
• Check the link by hovering your mouse over it. The address will appear at the bottom of your screen. Make sure this is correct before acting on it
• For cold calls, don’t be afraid to ask the person’s name. Call them back on a publicly listed number to verify as genuine
• Social media scammers use fake social media accounts:

• Look at the number of followers. Fake social media accounts often show only a few followers
• Check the activity on the accounts, the number of posts made and how often they are made.
• See when the account was created. A recent account may indicate it has been set up as a fake.

A caller says they are from your bank, the Police or a well-known company and that your computer, mobile device or accounts have been hacked, they need your help to catch the hackers or bank staff under investigation. You may be asked to transfer money to New Zealand or offshore accounts to download an app giving them remote access to your mobile, computer or device or to withdraw cash in branch and have this along with cards and PINs ready for pick up from your home.

They may claim it’s an Interpol operation, so your local police station won’t know about or that bank staff are involved in the scam, and you can’t say anything in case you tip them off.

An unexpected caller who’ll often pressure you to act immediately. They impersonate banks and well-known companies and will ask you to share private information (e.g. two-factor authentication codes (2FA), PINs, passwords, or other personal or bank details). They may pressure you to allow remote access to your device. The scammer may also be trying to log into your online banking, which is why they ask for your information.

Common examples of cold calls:

• There’s a fraudulent transaction or suspicious activity on your account
• Fraudulent payments have been set up to send money to New Zealand or overseas accounts and they can help stop these, but they need your 2FA code to stop the transactions
• There’s a problem with your computer or mobile device
• Your help is needed to catch hackers or bank staff involved in fraudulent activity
• You have a refund or payment due
• You have to pay an invoice or bill
• Your bank accounts are at risk and you need to transfer your money to a “safe account”

When someone gains access to your device (i.e. smartphone, tablet or computer), it could allow them to access your Internet Banking or Mobile Banking app and make payments from your device. Remote access can also be used to steal your personal details or any data saved on that device, or to impersonate you.

Common signs of this scam:

Scammers will phone, text or email to say:

• There’s a problem with your internet connection
• Your device has an issue or needs maintenance
• You need to download a file or app to help resolve an issue
• You’re being hacked, and they can help stop it
• They’ve seen unauthorised transactions and can help stop it

Scammers might even provide stop-by-step instructions or offer to walk you through the process, including logging into your Internet Banking or Mobile banking app.

Scammers may use QR codes to download malicious software to your device or lead you to a fake website to enter your details to win a competition or giveaway – but there’s no prize.

How to avoid this scam:

• Think twice before clicking the link from a QR code – you should be able to see the URL before you click on it
• Don’t enter your details until you’ve checked if it’s a legitimate competition or giveaway
• If the QR code seems to be from a business or organisation, check their official website or social media accounts promote the competition or giveaway

Malvertising is a malicious online advertising technique that involves the distribution of malware through online ads or browser push notifications. Cybercriminals use these seemingly legitimate ads to deliver malware to unsuspecting users’ devices when they click on or interact with the compromised advertisements. For more information click here

Never input personal information into unknown sites and install anti-virus software.

Scammers have or pretend to have, intimate images or videos to blackmail you into sending money.

They may make contact on social media, pretending to be someone of a similar age to build trust. The scammer may start by sharing intimate images to encourage the person to share their own. They may claim to have access to the person’s contact list and threaten to send the images.

If this happens, don’t respond or send money to the scammer. Report it to your local Police and tell a trusted friend or family member so they can support you.

You receive a message saying you’ve won a prize from a travel competition or lottery that you haven’t entered. To claim the prize, you need to pay a fee to cover tax or other cost.

You shouldn’t have to pay to claim a prize, and it always helps to check if it is a legitimate competition before entering any personal details or paying for a chance to win.

How to avoid this scam:

• Check if it’s a legitimate competition – scammers may create fake profiles to copy competitions run by companies and organisations
• Don’t click any links to claim your prize
• Don’t reply to the message – if you’re unsure if the prize is genuine, use contact details on the official website or social media account of the business or organisation.

An automated call says it is your bank or credit card provider and there’s a suspicious transaction on your account. You’re asked to press 1 to speak to the fraud team and then asked for personal details or to provide remote access to your computer, mobile or device.

Hang up immediately and don’t provide any personal details. Call your bank using the number on their website or on the back of your card.

Fraudsters phone customers pretending to be bank staff and say their bank accounts are at risk of fraud or there is suspicious activity on their account. They may say that money needs to be moved to another account to protect it, request your online banking log in details, debit card details or remote access to your device.

We recommend you end these calls immediately and report them to your telecommunications provider.

Don’t ever provide banking information to someone you don’t know who calls, messages or emails you unexpectedly. Always contact Unity via a phone number or other contact method listed on our website and speak to a Unity staff member to confirm the legitimacy of the contact.

Contact us

Members of our team may contact you from time to time, however, we will never ask you:

• For your banking passwords or PINs
• Your full card number or CVV
• To download software or remotely access into your device

You receive an invoice for a product or service you haven’t ordered or received, or a business email is hacked to send invoices with a different account for payment.

You may be expecting an invoice. A scammer intercepts it to change the bank account, so they get the funds instead, or they send a follow up email claiming the business forgot to update the bank account. Some scammers set up auto forwarding so if you email to question the invoice, the scammer will reply, not the business.

How to avoid this scam:

• Always contact the business directly (preferably by calling them) to confirm the invoice and bank account number is correct before paying.
• If you’ve already transferred the funds, contact your bank immediately.
• Report the incident to Cert NZ or the Police

Never save your passwords, PINs, or credentials on your browser or devices (or write them down!). Change them regularly and consider using a password manager for strong, unique passwords across all accounts.

Properly dispose of bank statements, card statements, and other documents containing personal information.

Double-check the account name and number before making any kind of transfer or payment. For example: we don’t use account names for processing payments – only account numbers. Mismatched information is a red flag for potential scams.

Shop with reputable companies and beware of unfamiliar online sites. Look for the locked padlock symbol in the browser address bar.

Don't grant remote access to your device to anyone who contacts you unexpectedly. Downloaded software used by fraudsters can capture your personal and banking login details.

Be wary of clicking links or opening attachments in emails, text messages, or on unfamiliar websites. Hover over a link with your mouse to see the actual destination URL before clicking. On smartphones, press and hold the link to see the URL.

Avoid making payments, accessing online banking, or doing anything personal when using public Wi-Fi, as it may not be secure. Use your mobile data plan instead.

Be mindful of what you share on social media, especially your date of birth, address, and financial details.

Limit connections to people you know and trust. Fraudsters can use what you share to impersonate you.

Set your posts to "Friends Only" or a custom list to control who sees your information.

Set a strong password, PIN, pattern, or biometric authentication (fingerprint, face, or voice recognition) for your mobile device and computer.

Set locks for banking apps and security settings on your device.

Never share your password, PIN, or pattern with anyone. Don't allow anyone to register their fingerprint, face, or voice for unlocking your device.

Don't give remote access to your computer or device to anyone who calls you unexpectedly.

If you sell your device, reset it to factory settings first.

Lock your mobile device and computer when you're not using them and log out of apps.

Update the operating systems and apps on your devices regularly. Set them to auto-update for the latest security patches.

Keep your antivirus software up to date and run regular scans.

Only install apps from official app stores like the App Store or Google Play.

Check app popularity, reviews, and developer information to confirm its legitimacy. Fake apps can exist even on official stores.

Make sure app permissions (e.g., access to personal data) are reasonable for the apps function.

Review how your data will be used by the app.

Delete apps you no longer use.

Limit access if necessary. Be cautious if other people have access to your device. If someone else's fingerprint, face, or other biometric identification is stored on your device, don't enable biometric access for your banking apps. Don't enable mobile wallet cards on a shared device.

Backup your mobile phone, devices, and computers to protect data like names, addresses, photos, files, and documents.

Use a strong password to prevent unauthorised access to your backup. Consider storing a copy of your information (e.g., photos, files, documents.)

All personal passwords must meet minimum strength requirements to prevent unauthorised access.

Your initial download of the Unity Mobile Banking app requires your full Internet Banking username and password. This extra step helps prevent unauthorised access.

Our team actively monitors your accounts for unusual activity. If we suspect suspicious transactions, we'll contact you to confirm if they're legitimate. It's important to regularly review your transactions and let us know in advance if you're traveling overseas and plan to use your card.

Think of your CVV (the 3-digit code on the back of your debit card) as a password. With Dynamic CVV, this password changes regularly on your digital debut card, making it harder for fraudsters to use your card details, even if they have them. It's like having a new password every time you make an online purchase.

You have the power to decide when and where you want to use contactless payments. With a simple switch in our Mobile Banking app or in Internet Banking, you can easily turn this feature on or off, giving you complete control over your transactions.

A simple check to help you make sure you're paying the right person. It confirms whether the account name and number match before you send money.