The legal framework
Reports go to the national cyber security agency, which triages and refers on, and to the police for criminal matters. The banking sector operates a code that sets expectations on fraud prevention and on how customer claims are handled. A free, independent banking ombudsman scheme resolves disputes. Suspicious texts are forwarded free to a national short code.
CERT NZ receives reports of cyber incidents and scams and routes them to the agencies that can act, and the banking industry's code of practice sets out shared responsibility between banks and customers for unauthorised transactions. A voluntary reimbursement framework for scam losses has been developed with the banks, with a confirmation-of-payee service introduced to catch mismatched account names.
Key points
| Reporting | National cyber security agency, with triage and referral |
|---|---|
| Police | Separate criminal report |
| Banking code | Sets expectations on prevention and on handling claims |
| Dispute resolution | Free and independent banking ombudsman scheme |
| Suspicious texts | Forward free to the national short code |
| Consumer protection | Commerce Commission for misleading conduct |
| Cryptocurrency | Effectively unrecoverable |
In practice
- Report to the cyber security agency first: it can act on the infrastructure behind the scam.
- Use the banking ombudsman if the bank refuses — it is free and independent.
- Forward scam texts to the national short code; it is free and leads to numbers being blocked.
- Keep every message and transaction reference before blocking the account.
Cost and coverage
Reporting and the ombudsman scheme are free.
Where to go
- National cyber security agency reporting form.
- Police, for criminal reporting.
- Your bank's fraud line, immediately.
- Banking ombudsman scheme, free and independent.
Worth knowing
Reporting to the cyber security agency is not just symbolic: it is what gets fraudulent sites and numbers taken down, which protects the next person approached.
Frequently asked questions
Is there confirmation of payee in New Zealand?
Yes — banks have introduced an account-name checking service so that you are warned if the name you type does not match the account you are paying. It is one of the most effective single measures against invoice and impersonation fraud. Take the warning seriously; do not override it on the strength of a phone call.
How do romance scams usually work?
A months-long build-up of affection, always with a reason not to meet or to video-call, followed by a first emergency — a medical bill, a customs charge, a blocked transfer — and then an escalating series of them. The newer variant adds an investment platform that shows a rising balance you can never withdraw. The tell is not the story; it is that money must always move away from you, and quickly.
Official sources and links
- Netsafe — free advice and reporting for online harm and scams
- CERT NZ, via the National Cyber Security Centre — national incident reporting
- Banking Ombudsman Scheme — free and independent dispute resolution
- Financial Markets Authority — warnings and alerts — unregistered platforms and scam websites
- govt.nz — official government information
- New Zealand Legislation — acts and regulations