Fake IRD refund email doing the rounds
A phishing email is circulating across NZ that pretends to be Inland Revenue and pushes you to click through to myIR to claim a tax refund.
You could receive an email with the subject line "New letter from Inland Revenue" and a simple plain text layout starting with "Kia Ora". It impersonates Inland Revenue and tells you to click through to myIR to review pending information and claim a tax refund. If you are moving quickly, it can look like a routine government message asking you to log in.
What gives it away is behind the scenes. The message was sent from riversideadubuilders.com, which has nothing to do with Inland Revenue, and the mail system could not properly verify that it was authorised to send on behalf of the brand it was pretending to be. That means the sender identity does not stack up, even though the email tries to look familiar. The domain itself is not new, but it is still unrelated to the organisation being impersonated, which is the key red flag here.
The attacker is after your myIR credentials. If you click and sign in, you could hand over access to tax information, personal details, and anything else tied to that account. That can lead to follow-on fraud, account misuse, or further phishing aimed at your staff.
Treat any unexpected Inland Revenue message asking you to log in or claim money with caution. Go to myIR by typing the official address into your browser or using a saved bookmark, never through a link in the email.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Verify any Inland Revenue request by signing in through the official myIR site using your own bookmark or typed address.
- Do not: Click links or enter credentials from unexpected tax refund or account review emails.
- Check: Review with your IT provider whether similar messages were delivered to your organisation and whether staff interacted with them.
- Report: Report suspicious Inland Revenue themed emails through your usual security channel so they can be blocked and removed.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Inland Revenue (IRD) message looks like, the real sender domain, the real link destination, and where to report a fake.