Fake ANZ alert wants you to panic

You may receive an email with the subject line “ANZ Online: Suspicious Login Attempt Detected - Reactivation Needed!” claiming to come from ANZ security or fraud prevention. It says your access has been temporarily restricted after a login attempt from Auckland on an iPhone and urges you to reactivate or secure your account straight away. The message is designed to feel urgent and local, so you act before thinking.

What makes this tricky is that the email can pass normal sender checks, which means your mail system may not flag it as fake. But the sending domain is comgsproduction.com, not an ANZ-owned domain, and it has no established history as a recognised banking sender. If there is any reply-to mismatch, your response would go somewhere other than the address you think you are dealing with, which is a strong sign the message is not genuine.

The attacker is after your banking or business credentials, and possibly any follow-up details you provide if you reply or click through. If you engage, you could hand over account access, expose your organisation to payment fraud, or give the attacker a foothold for wider compromise.

This has been observed across multiple Microsoft 365 tenants, which means you are not being singled out. It keeps appearing because the email looks believable, uses a real-looking domain, and can slip past basic trust checks even though it is impersonating a major NZ bank.