How I got caught out by a tax scam

I was working two jobs at the time, teaching creative writing part-time in the evenings as well as full time at Consumer NZ.

The secondary income from my part-time job always meant I’d have to pay some tax. But when I googled myIR and logged onto what I thought was the right website, it told me I had a refund. It asked me to enter my credit card details to get the payment.

I did think it was strange for the website to request my credit card details rather than just credit my bank account like it had in the past. Still, it was a refund, and I would rather have the money than leave it sitting with Inland Revenue (IRD).

I was rushing too, about to head out the door to teach a class, so I just did it.

And then instant regret: of course, it wasn’t a refund, this was a scam! The website was fake, and I’d just given them my IRD login details, as well as my credit card details.

I got on the phone to IRD to see if my fears were founded. The person I spoke with couldn’t really tell me for sure, though they did reset my password for myIR.

I then went onto my banking app and stopped my credit card. Then I called the bank and asked it to cancel the card and issue me a new one.

All the while, my heart was thumping. I couldn’t believe how stupid I had been. I’d written articles warning people about scams, for goodness’ sake. Yet, I also knew I wasn’t alone in getting scammed.

In the first quarter of 2025, the National Cyber Security Centre (NCSC) received reports of losses totalling to $7.8 million. This was up from $6.8 million in the previous quarter.

“This is the second-highest quarterly total loss the NCSC has ever recorded,” said the organisation’s response and investigations team lead Tom Roberts in a media release.

But Roberts also noted that only a small proportion of scams are reported to the NCSC: the true scale of losses is likely to be much higher.

How to avoid being scammed

IRD is currently sending out around 3.7 million tax assessments. It’s a peak time for scammers.

“From past experience, we know that when we send out these assessments, scammers know and increase their attempts to rip off Kiwis,” IRD said in a media release.

Inland Revenue’s top tips to avoid being scammed

IRD will only pay refunds directly into the bank account it has on file. If it doesn’t know your bank account, it will ask you for the details through the myIR online portal or its call centre (0800 257 777). IRD won’t put the refund amount in an email or text and won’t ask for your credit or debit card in order to pay it.

To see if you have any messages from IRD, go directly to ird.govt.nz and use the myIR login at the top of the webpage. From there you’ll be able to see whether you have messages from the IRD.

If you do end up with a tax bill, you will have until February 2026 to pay it. Scammers are likely to try to hurry you into paying the bill immediately, but if it’s a legitimate bill, you will have plenty of time.

If you think you have received a scam, you can forward it to [email protected].

We want action to stamp out scams

We’ve been calling for government action to stamp out scams by making banks, social media platforms and telcos work together to tackle the problem.

Yet, it appears each sector is working independently, when we need the government to take the lead.

Banks have introduced a new compensation scheme for scam victims, but we think the scheme has significant shortfalls.

Scammers can access victims in many ways, including:

• phone calls or text

• social media

• online marketplaces.

Until now, social media and online marketplaces have been slow to join efforts to stamp out scams.

However, the telecommunications industry has a voluntary scam prevention code.

In mid-June, the telecommunications industry announced a review of its scam prevention code. The code aims to reduce the number of text message scams, share information within the sector and with other parties like banks and government agencies, minimise the harm to New Zealanders and educate us on how to avoid scams.

Yet, there’s no set time frame on when the revised code should be delivered.

Paul Brislen, the chief executive of the telecommunication forum, said the time frame will depend on how many public submissions come in. However, he does expect to have a new code ready by the end of the year.

If it’s anything like the banks’ scheme, we are concerned the code will:

• allow the industry to regulate itself

• be voluntary

• form consumer protections that fall short of overseas protections.

We will continue to put pressure on the government to introduce a national scam framework that brings banks, social media, online marketplaces and telcos together to stamp out scams.

Please consider adding your voice to our call for stronger scam protections and sign this petition.