How to report a scam email in New Zealand

You can report a scam email in New Zealand by forwarding it to the National Cyber Security Centre, your email provider, and, if money or banking details were involved, your bank and the Police. Reporting takes a few minutes and directly helps take scam infrastructure down.

Report to NCSC NZ (National Cyber Security Centre)

Go to report.ncsc.govt.nz and use the phishing / scam email form. Attach the original message as a file (.eml) if you can. NCSC coordinates the national response and shares patterns with banks, telcos, and platforms so the same scam can be blocked for the next person.

Report to your email provider

In Outlook, click Report → Report phishing. In Gmail, open the message, click the three-dot menu, and choose Report phishing. This trains the spam filter for millions of other users on the same platform, so the same message is blocked at the door next time.

If it involved your bank

Call your bank on the number on the back of your card. All the major NZ banks — ANZ, ASB, BNZ, Westpac, Kiwibank — have dedicated scam and fraud lines that are answered 24/7. Don't use a phone number from the scam email itself.

If money moved, tell the Police

File a report at 105.police.govt.nz. Have transaction dates, amounts, and any screenshots ready. If it's actively unfolding — e.g. an in-progress remote-access call — dial 111.

Impersonation of a real NZ brand or agency

Most large NZ organisations have a dedicated phishing inbox. Forward the message with full headers to their reporting address — for example phishing@ird.govt.nz, phishing@anz.com, scams@nzpost.co.nz. Their security team uses these reports to take down lookalike domains.

Report on social media if that's where it started

Every major platform (Facebook, Instagram, LinkedIn, Messenger, WhatsApp, TikTok) has a "Report" option on the message or profile. Use it — those reports feed the platform's automated takedown pipelines and are usually the fastest way to get a scam profile removed.

Keep the evidence

Don't delete the original message straight after reporting. Keep it in a "Scams" folder for at least 30 days in case your bank, IT team, or the Police need to reconstruct the timeline.

Reporting quick-reference

Need help?

If you think you've been targeted or you're not sure what to do next, the Decision1 team can walk you through it. No cost for a first conversation.