Fake IR email wants your myIR log in

You could receive a plain-looking email with the subject line "New letter from Inland Revenue" that appears to be about tax or personal information updates. It impersonates Inland Revenue and tells you to log in to myIR using a link in the message, typically framed as a new letter waiting for you to review.

What gives it away is that the email only looks legitimate on the surface. Some of the usual mail checks passed, which helps it slip through, but the sending setup is still not right for a genuine Inland Revenue message. The domain behind it is unrelated to Inland Revenue, and while it is not brand new, it has no legitimate connection to myIR. That means the email is relying on appearance rather than real authority.

The attacker is after your myIR login details. If you click through and enter your credentials, you could hand over access to tax information, personal details, or business records. That access can then be utilised for further fraud, identity misuse, or follow-on scams aimed at your organisation.

This is not an isolated message. It has been observed across multiple Microsoft 365 tenants in a short window, which means other NZ businesses are likely seeing the same lure. These campaigns keep appearing because even a basic, low-polish email can still catch someone at the wrong moment.