Cash lure email trying its luck
A phishing email is circulating that pretends to be from Air New Zealand and claims you have received a cash amount, using an rci.com sender that your mail system could not verify as genuine.
You may see an email with the subject line "congratulations You have received 392 NZD." It presents itself as an Air New Zealand update and the message preview shows a cash amount of 392.64 with a welcome-style message, pushing you to open it and follow through as if you are claiming or confirming a reward.
What gives it away is that the sending domain does not match the brand being advertised. The email came from rci.com, not Air New Zealand, and your mail system could not properly verify that it was authorised to send on behalf of that domain. In plain terms, the message failed key trust checks, so there is no reliable proof it came from who it claims to be. Even though rci.com is an older domain with a long history, that age does not make this message safe when the identity checks fail and the branding does not line up.
The attacker is trying to get you to click, reply, or hand over details by dangling a fake payment. If you engage, you could be pushed to a phishing page, tricked into sharing login credentials, or drawn into a follow-up conversation that asks for personal or business information.
Treat this as a brand impersonation phish. If it lands in your inbox, do not interact with it. Report it internally, then delete it so nobody else in your organisation follows the bait.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Look closely at the sender domain and the brand being referenced. If the email claims to be from Air New Zealand but comes from an unrelated domain, treat it as suspicious.
- Do not: Click links, reply, or provide login details or personal information in response to reward or payment emails you were not expecting.
- Report: Use your organisation's phishing reporting process or send it to your IT provider so blocking and mailbox checks can be completed.
- Delete: Remove the message after reporting it, and warn staff if the same subject line is circulating across your business.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Air New Zealand message looks like, the real sender domain, the real link destination, and where to report a fake.