Fake NZ Post delivery alert wants to trick you into confirming your details
Scammers are impersonating NZ Post with realistic delivery failure notifications to harvest personal and financial information.
A phishing campaign masquerading as New Zealand Post is currently targeting local residents with fake delivery updates. These messages claim that a parcel is held at an Auckland Depot and require you to "Confirm Delivery Information" to proceed.
This activity was flagged due to its high frequency and the use of realistic tracking identifiers that mirror legitimate courier notifications. The attackers leverage common delivery expectations to elicit quick, unverified interactions from busy staff.
Technical analysis indicates a major contradiction: while the email layout uses official branding, the sending domain is unrelated to New Zealand Post infrastructure and was registered only nine days ago. Official postal notifications always originate from established, verified government and carrier domains.
The impersonation is surprisingly realistic, featuring high-fidelity logos and a clear "Delivery Notification" header. The inclusion of a specific tracking number and a professional status update is designed to bypass standard security suspicions during a routine day.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Verify Independently: Always check tracking numbers directly on the official
nzpost.co.nzwebsite, never via links in unexpected emails. - Check the Sender: Official NZ Post alerts will only come from verified @nzpost.co.nz addresses, not unrelated international service domains.
- Ignore Deadlines: Be sceptical of any message using 24-hour deadlines to pressure you into confirming shipping details or paying fees.
- Forward to 7726: If you receive a suspicious delivery notification via SMS, forward it to the 7726 reporting line for free.
See what a genuine NZ Post message looks like, the real sender domain, the real link destination, and where to report a fake.