IRD refund email is trying it on
A phishing email impersonating Inland Revenue is telling you to log in to myIR to fix account details and claim a refund.
You could receive a plain text email pretending to be from Inland Revenue, using the subject line "Inland Revenue - Pending Refund #20260920-00004". It pushes you to review your details, fix a bank account mismatch and click through to a myIR log in page within 72 hours so you do not miss a refund. If you have seen a tax refund email with that sort of wording, this is the one.
What gives it away is that the sending domain is not an Inland Revenue domain, even though the message tries to look legitimate. The email system could not properly verify who really sent it, and there is no trusted mail authentication backing the message. That means you should treat the apparent sender as untrusted, regardless of how familiar the branding looks.
The attacker is after your myIR credentials and any details you enter after clicking. If you sign in through the link, your login could be captured and utilised to access tax information, change account details or support wider fraud against your business.
This campaign has already been seen circulating across NZ organisations in the last day, so it is not just a one-off test. If you receive anything claiming to be from Inland Revenue about a refund, go to myIR directly through your usual saved link instead of the email.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Verify any Inland Revenue message by going to myIR directly through your usual saved bookmark or the official IR website.
- Do not: Click links or enter login details from refund emails, especially if the sender domain does not belong to Inland Revenue.
- Check: If anyone in your organisation clicked the link, review affected accounts immediately and reset passwords.
- Report: Send suspicious Inland Revenue themed emails to your IT provider or security team for review.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Inland Revenue (IRD) message looks like, the real sender domain, the real link destination, and where to report a fake.