Manage My Health

What real Manage My Health communications look like

• Manage My Health states it will never ask for your password by email or phone, and never ask for a one-time security code. Never share a verification code with anyone
• It will never ask you to sign in through an email link to claim a refund, and will never ask for your card details or bank codes
• Its security page advises you to always type managemyhealth.co.nz directly into your browser before logging in, and to avoid login links in unsolicited emails or messages
• If you were affected by the December 2025 cyber incident, Manage My Health says it contacts affected people directly. You can also check your Account Security Status by logging in and looking at your Dashboard. Seeing "under review" does not mean your account was affected
• Two-step verification is mandatory for all users. A code is sent to your registered email by default (or you can use an authenticator app) only when you are signing in yourself. A verification code you did not request is a warning sign, so do not share it and contact support
• The only support email in its current scam alert is support@managemyhealth.co.nz. Support is open 9am to 5pm Monday to Friday, closed on NZ public holidays
• Unsure about a message? Go to Manage My Health directly through its website or app and not through an email link

Common spoof patterns

• Fake refund emails with a button that leads to a copy of the sign-in page
• Messages that use the 2025 cyber incident as a pretext. Unexpected or urgent messages about the breach, a "security check" or a compensation payment should be treated with suspicion, because the genuine company is also contacting affected people
• Anyone contacting you claiming to have your health information. Manage My Health advises you not to engage, to call NZ Police on 105 (or 111 in an emergency) and to report it to Manage My Health support
• Requests for a verification code that arrives when you did not try to sign in

Note for NZ organisations

Manage My Health is used by most GP practices, so your staff, and your staff's families, are likely to be patients of it. A stolen portal login can expose medical records, lab results and prescriptions, which cannot be changed the way a password can. The phishing is easier to believe because the 2025 incident was real and is widely known. If someone has entered their portal email and password on a page they are unsure about, Manage My Health says to sign in through its website or app (not the email link) and change the password straight away, change it anywhere else it was reused, and contact support@managemyhealth.co.nz. If card or bank details were entered, contact the bank straight away to block the card.