Airpoints dollars just for you, but also, not.
A phishing email posing as an Air New Zealand payment notice is circulating across NZ, using a fresh sender domain and weak authentication to try to get you to click or reply.
You may see an email with the subject line "You have received 392.64 NZD" that appears to reference Air New Zealand and looks like a payment or account update. The message body uses Air New Zealand branding and the amount 392.64 to make it feel legitimate, pushing you to open it and act on what looks like a money-related notification.
What gives it away is that the sending domain, capsulesmade.com, has no established history as a trusted sender and was only registered recently. The email system could not properly verify who really sent the message, even though one technical check passed, which is a common sign of spoofing or abuse of a compromised sending path. If you reply, your response may not go where you expect, which is another strong clue that the apparent sender is not the real organisation.
The attacker is likely trying to get you to click through, hand over account details, or start a back-and-forth conversation they can exploit for payment fraud or credential theft. If you engage, you could end up giving away sign-in details, exposing business information, or being redirected into a wider scam that targets your organisation.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Inspect the sender address and any reply details carefully before acting on payment or account emails that reference well-known NZ organisations.
- Do not: Click links, open attachments, or reply to unexpected payment notifications, especially if the message creates urgency around money.
- Verify: Contact Air New Zealand or the relevant organisation through its official website or known customer service channel, not through the email.
- Report: Send suspicious messages to your IT provider or internal security contact so they can block similar emails and review whether anyone interacted with them.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Air New Zealand message looks like, the real sender domain, the real link destination, and where to report a fake.