Fake myIR email wants your login
A phishing email posing as Inland Revenue is pushing you to click through to myIR and “update” tax and bank details using a sender domain that has no obvious connection to IRD.
You could receive an email with the subject “Notice: Tax Refund Confirmation and Processing Status Update” that looks like an Inland Revenue message. It tells you there are new letters in myIR, mentions an income tax assessment and a bank account details mismatch, and urges you to click a link to log in and review or update your information. The wording is designed to feel routine but urgent, so you act before thinking twice.
What gives it away is the sender. The message is coming from arroceandocv.es, which has nothing to do with Inland Revenue or myIR. Even though the email passed technical checks in transit, that only shows the sending domain authorised the message, not that the sender is genuinely IRD. In plain terms, the email system could confirm who sent it, but who sent it was still the wrong party.
The attacker is after your myIR credentials and potentially your personal or business tax information. If you click through and sign in, you could hand over access that can be used to view sensitive records, change account details, or support further fraud. If bank details are updated as part of the scam, the financial impact can become immediate.
This campaign is already circulating across New Zealand organisations, so treat any unexpected tax refund or myIR update message with caution. If you were not expecting Inland Revenue contact, go to myIR directly through your own saved bookmark or the official IR website, not the email link.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Verify any myIR or tax message by signing in through the official IR website or your saved bookmark, never through the email link.
- Check: Look closely at the sender domain. If it is not an official Inland Revenue domain, treat the message as suspicious.
- Do not: Enter credentials or update bank or tax details after following a link from an unexpected email.
- Report: Flag the message to your IT provider or security team and remove it from inboxes if it has circulated internally.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Inland Revenue (IRD) message looks like, the real sender domain, the real link destination, and where to report a fake.