You can tell if an email is a scam by checking a handful of simple signals: the sender's real address, the urgency of the message, the destination of any links, the greeting, and any unexpected attachments.
Hover over the sender name to see the full email address. Look at the domain — the part after the @ symbol. A legitimate message from a bank won't come from a Gmail address or a domain that has extra letters, hyphens, or numbers in it (e.g. anz-nz-secure.com instead of anz.co.nz).
Scam emails almost always try to rush you. Phrases like "act immediately", "your account will be closed", or "final notice" are red flags. Real organisations give you time and multiple ways to respond.
Hover over any link (don't click) and check the URL that appears in the corner of your browser or email client. If the visible text says ird.govt.nz but the actual link points somewhere else, don't click. On mobile, long-press the link to preview.
Generic greetings like "Dear Customer" or "Valued User", awkward grammar, and slightly off phrasing are strong signals. Real emails from your bank or IRD usually address you by name.
Never open attachments you weren't expecting, especially .zip, .exe, .html, or .iso files. Scam invoices often hide malware in attached PDFs too.
If an email claims to be from your bank, IRD, NZ Post, or any other organisation, don't click the link. Open your browser and go to the site directly, or call the organisation on a number you already have (from a card, statement, or the official website).
If you think you've been targeted or you're not sure what to do next, the Decision1 team can walk you through it. No cost for a first conversation.