IRD tax email is trying it on
A phishing email is circulating across NZ pretending to be Inland Revenue, pushing you to validate your tax details through a fake assessment notice.
You get an email with the subject line Important: Your Tax Assessment, appearing to relate to Inland Revenue. It talks about your 2026 income tax assessment, says your information is incorrect or incomplete, and urges you to click a Validate Your Information button. It is designed to feel routine and urgent, like a genuine tax compliance message you should deal with straight away.
What gives it away is that the message does not properly prove who sent it. Your email system could not verify it through the normal sender checks, and there was no signed evidence linking it back to a legitimate Inland Revenue mail system. The sending domain, irdnzdi.20fr.com, is also not an official Inland Revenue address. Even though the domain itself is old, that does not make this message trustworthy, it just means attackers are using a domain that can look less suspicious at a glance.
The goal is to get you to click and hand over information through a fake tax workflow. If you engage, you could give away personal or business details, login credentials, or other information that can be utilised for further fraud, account compromise, or follow-up scams. Treat it as a phishing attempt and keep well clear of the link.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Review any recent tax-related emails carefully and confirm Inland Revenue messages only through official myIR channels or the IR website.
- Do not: Click the button or enter any details if an email pressures you to validate tax information unexpectedly.
- Verify: Look closely at the sender domain. Inland Revenue should not be contacting you from irdnzdi.20fr.com.
- Report: Send suspicious messages to your IT provider or security team so they can block the sender and check whether anyone engaged with it.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.