Fake sign-in scare in your inbox
A phishing email posing as a security alert is circulating across NZ, pushing you to click a Verify Identity link after claiming there was an unrecognised sign-in.
You get a plain text email with the subject line Unrecognized Sign-In Attempt, appearing to come from a generic Customer Security Team. It warns that someone tried to log in to your account from an unrecognised device and urges you to click Verify Identity. There is no real brand styling, other than a partial Kiwibank logo and a blunt security warning designed to make you act fast.
What gives it away is that the message does not hold up when your mail system checks who really sent it. The email failed key authenticity checks, which means the sender could not properly prove it was authorised to send on behalf of the identity it presented. It came from fruitsandroots.de, a domain with no established history as a trusted sender for account security notices, which is another strong sign this is not a legitimate login alert.
The attacker is trying to steal your credentials by pushing you onto a fake verification page. If you click and sign in, they can capture your username, password, and potentially any follow-up security details, then use them to access your email or business systems. A stolen mailbox can quickly lead to invoice fraud, internal impersonation, and wider compromise across your organisation.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Review any email with unexpected sign-in warnings carefully, especially if it pushes you to verify your identity straight away.
- Do not: Click Verify Identity or enter your password from a link in an unsolicited security email.
- Check: If you are worried about your account, open the service directly from your usual bookmark and review recent sign-in activity there.
- Report: Report the message to your IT provider or security team so the sender domain and similar lures can be blocked.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Kiwibank message looks like, the real sender domain, the real link destination, and where to report a fake.