Warning over ‘convincing’ NZ Post scam

The scammers ask for a tiny amount - 85c - but their real aim is to harvest your credit card details. Image / @dylanreeve

NZ Post is the latest firm being impersonated by text scammers - with messages linking to a “convincing” fake of the company’s site.

Fake Believe author Dylan Reeve tweeted that he had received two text messages purporting to be from NZ Post this morning.

They linked to “a pretty convincing fake version of the NZ Post website,” Reeve said.

I've received two fake @nzpost delivery failure texts this morning.

It directs to a pretty convincing fake version of the NZ Post website.

At first I was confused as to the scam, because it's just asking for address details for a redelivery... pic.twitter.com/l8Uc7SKneD

— Dylan Reeve (@DylanReeve) July 9, 2023

“But then comes the real meat. Once you provide address details there is a nominal redelivery fee [of 85c],” he added.

“And this will be where your card details are harvested, or possibly you’re signed up for some high-cost recurring ‘subscription’.”

NZ Post has been asked for comment.

Experts say to be suspicious of any text that comes from an overseas number, or any text that comes from a regular NZ cellphone number. Service providers usually send messages from a service that uses a 4-digit short-code. Reeve told the Herald the scam text came from a regular cell number.

Any request to click on a link is another red flag. Most legitimate service providers don’t ask you to click on a link in a text message, although there are exceptions. If in any doubt, phone the service provider, using a link you’ve sourced from its website.

NZ Post lists common scams on its website, and says:

NZ Post will never:

• Ask for any of your personal information by email or text (including usernames, financial information including password, credit card details or account information)
• Send you an email from a domain other than nzpost.co.nz
• Send you a text message from a phone number outside of New Zealand
• Use a messaging app like WhatsApp to communicate with our customers

Hints that it’s a scam:

• The email address is wrong - it will always end in ‘@nzpost.co.nz’
• The website link is wrong - it will always link to ‘nzpost.co.nz’ or ‘http://nzp.st/’ which is the short link we often use to link to our website.
• The text message is sent from an overseas phone number

Chris Keall is an Auckland-based member of the Herald’s business team. He joined the Herald in 2018 and is technology editor and a senior business writer.