Fake IRD email wants your myIR login
A phishing email is circulating that pretends to be Inland Revenue and tries to get you to log in to myIR through an unverified sender domain.
You might see an email with the subject line "No-reply" that looks like it comes from Inland Revenue, using New Zealand Government branding and language about a new message in myIR. It tells you your myIR account needs verification, gives you a reference number, and pushes you to click through and log in to review your contact details and new letters.
What gives it away is that the message does not stand up to basic trust checks. The sending domain is a1c892ba4c.nxcli.io, which has nothing to do with Inland Revenue, and the mail systems could not properly verify that it was authorised to send on behalf of the brand it claimed to represent. Even though one compatibility check passed, the important identity checks failed or were missing, which means you cannot rely on the apparent sender being genuine. That kind of throwaway subdomain also has no established history as a legitimate government sender.
The attacker is after your myIR credentials. If you click and enter your details, you could hand over access to tax records, business information, and contact details that can be used for further fraud. A stolen government login can also be reused in follow-on scams, especially if the same password is used elsewhere.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Where a reply to this message would actually be delivered. When it differs from the visible From address, an unsuspecting reply lands with the attacker instead.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Inspect any Inland Revenue themed email carefully before acting, especially if it asks you to verify your account or log in urgently.
- Verify: Go to myIR by typing the official website into your browser yourself, not by clicking a link in the email.
- Do not: Enter your username, password, or any verification code after following a link from an unexpected message.
- Report: Forward suspicious phishing emails through your normal internal reporting process or to your IT provider for review.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Inland Revenue (IRD) message looks like, the real sender domain, the real link destination, and where to report a fake.